Google Cloud

Automate your team's infrastructure and ensure resource access is automatically kept in sync with team membership.

Setup

1. Create or sign into your Google Cloud account

2. Connect your Google Cloud organization to Hyphen

  • Sign in with your Google account
  • Select the GCP organization you wish to connect
  • (Optional) Select a billing account

That's it! After you've completed these steps, Hyphen will automatically:

  • Verify the credentials and selected organization
  • Grant necessary permissions to the Hyphen service
  • Configure the domain-restricted sharing policy to allow access from Hyphen

Required Permissions

The one-click installation requires the following permissions:

resourcemanager.organizations.getIamPolicy
resourcemanager.organizations.setIamPolicy
resourcemanager.organizations.get
billing.accounts.list
orgpolicy.policies.create
orgpolicy.policies.update
orgpolicy.policies.get
orgpolicy.policies.list

Required OAuth Scopes

To perform the setup and ongoing management securely, Hyphen requires access to specific Google Cloud scopes:

https://www.googleapis.com/auth/cloud-platform

This broad scope allows Hyphen to manage resources across your GCP organization. It is required to:

  • List organizations
  • Set the domain restricted sharing policy
  • Assign roles to the Hyphen service account, including:
    • Organization Administrator
    • Folder Creator
    • Project Creator
    • Artifact Registry Administrator
    • Compute Network Admin
    • Cloud Run Admin
    • Service Usage Admin
    • Billing Account User

These roles are necessary to let Hyphen create and manage GCP projects and resources on your behalf.

https://www.googleapis.com/auth/cloud-billing.readonly

This scope allows Hyphen to:

  • List available billing accounts

This is optional but recommended to allow you to associate a billing account during project creation.


Connections

Permission Group

Permission group connections correspond to Google Workspace distribution lists and require an existing Google Workspace integration within the Hyphen organization. Connections can link to existing Groups in Google Workspace, or a new group will be created if no input is provided.

If a distribution list already exists for the same resource in Google Workspace, it will be used as the Permission Group connection.

When creating a new Group in Google Workspace, the Hyphen team name will be used as the group name.

Configuration

FieldTypeDescription
groupIdstringUnique group ID in Google Workspace.
groupNamestringDisplay name of the group in Google Workspace.
groupEmailstringUnique group email used for reference in future requests.

Connection Input

Provide the Google Workspace group email to create a connection to an existing Group.

Verification

ScenarioAction
Group has an ownerVerification handled by the owner.
No owner existsA verification email is sent to the group email.

Folder

Folder connections can link to existing folders in Google Cloud, or a new folder will be created if no input is provided.

When creating a new folder in Google Cloud, the Hyphen project name will be used as the folder name, adjusted to include only alphanumeric characters.

Configuration

FieldTypeDescription
folderIdstringUnique folder ID in Google Cloud.
folderPathstringPath in the format folders/{folderId}.
folderNamestringDisplay name of the folder in Google Cloud.

Connection Input

Provide the Google Cloud folder ID to create a connection to an existing Folder.


Cloud Workspace

Cloud Workspace connections can link to existing projects in Google Cloud, or a new project will be created if no input is provided.

A Google Cloud project relies on a Folder. If no Folder connection exists for the Hyphen project, a new Folder will be created.

When creating a new project in Google Cloud, the project name will combine the Hyphen project name and the Hyphen project environment name.

Configuration

FieldTypeDescription
projectIdstringUnique project ID in Google Cloud.
projectPathstringPath in the format projects/{projectId}.
projectNamestringDisplay name of the project in Google Cloud.

Connection Input

Provide the Google Cloud project ID to create a connection to an existing Project.

Access

A Team connection will be added with the "Owner" role when added to the project.


User

User connections correspond to Google Workspace users and require an existing Google Workspace integration within the Hyphen organization.

User connections can only link to existing users in Google Workspace. If no input is provided, the member email will be used to locate the user.

Configuration

FieldTypeDescription
userIdstringUnique user ID in Google Workspace.
emailstringUnique user email in Google Workspace.

Connection Input

A connection to an existing user can be created by providing the user email.

Test Connect