Manual Google Setup (no tools)

The guided setup tool is the quickest way to create the credential the connector needs, and it verifies the authorization for you. If you’d rather do every step by hand — or your environment is change-controlled — you can complete the exact same setup in the browser. No Google Cloud SDK is required.

All paths produce the same thing: a service account with a JSON key, authorized for domain-wide delegation with the single read-only scope https://www.googleapis.com/auth/admin.reports.audit.readonly. You’ll come away with a sa.json key file and a delegated admin email to put in the connector’s configuration.

You need to be a Google Workspace super-administrator to authorize the delegation.

Step 1: Create the service account and key (Google Cloud Console)

A Google Cloud project here is only a container for the credential — the service account is given no permissions in Google Cloud and reads no cloud data.

In the Google Cloud Console:

  1. Pick or create a project (top project dropdown).
  2. APIs & Services → Library → search Admin SDK API → Enable.
  3. APIs & Services → Credentials → Create Credentials → Service account. Give it a name (for example s60-google-connector); do not grant it any roles; click Done.
  4. Open the service account → Keys → Add Key → Create new key → JSON. A .json file downloads to your computer.
  5. On the service-account details page, copy its Unique ID (a long number) — this is the Client ID for Step 2.

If key creation is blocked

Newer Google organizations enforce a “Secure by Default” policy that blocks service-account key downloads. If the Add key option is greyed out with “Service account key creation is disabled”, an Organization Policy Administrator (roles/orgpolicy.policyAdmin, which the organization owner can self-grant) turns it off — scope the override to just this project so the rest of the organization is unaffected:

  1. IAM & Admin → Organization Policies.
  2. Find “Disable service account key creation” (iam.disableServiceAccountKeyCreation) → Manage policy → set the resource to this project → Override parent’s policy → add a rule Enforcement: Off → Save.
  3. Some organizations also enforce a legacy key-restriction constraint — if key creation is still blocked, disable that one the same way.
  4. Retry Keys → Add Key → JSON.

Step 2: Authorize domain-wide delegation (Admin console)

Only an administrator can read organization-wide audit logs, so you grant the service account permission to read them on behalf of an admin. This is the one step with no API, so it’s done by hand once.

In the Google Admin console, signed in as a super-admin:

  1. Security → Access and data control → API controls → Manage Domain Wide Delegation → Add new.

  2. Paste the Client ID from Step 1.

  3. Paste this OAuth scope (read-only audit logs only — not email, Drive, or user data):

    https://www.googleapis.com/auth/admin.reports.audit.readonly

  4. Click Authorize. (Propagation can take a few minutes.)

Step 3: Place the key and configure

  1. Put the JSON key next to your compose.yaml, named sa.json. If you created it on a different machine, copy it across — for example:

    scp ~/Downloads/your-key.json  user@yourserver:/path/to/stack/sa.json

  2. Create .env-google-connector with the delegated admin and one Secure60 destination:

    DELEGATED_ADMIN_EMAIL=admin@yourdomain.com
GOOGLE_CREDENTIALS_PATH=/secrets/sa.json
PROJECT_ID=301
TOKEN=your-secure60-ingest-token
# …or send to your Secure60 Collector instead:
# S60_COLLECTOR_BASE=https://your-collector:443

  3. Continue with Step 3: Run the connector.

Tip: you can still use the guided tool just to verify your manual setup — run it, point it at sa.json, and it will confirm the delegation works with a live check.

Back to top