5 Steps to Securely Integrate Google Cloud and Wiz in 2026

Securely integrating Wiz with Google Cloud requires establishing least-privilege service accounts, configuring Cloud Asset Inventory feeds, provisioning cross-project security visibility, enforcing scoped IAM permissions, and validating data streaming pipelines to maintain comprehensive cloud native application protection platform posture without exposing administrative surfaces.

Cloud security posture management has evolved from a passive auditing exercise into an active, continuous remediation discipline. Modern enterprises running complex architectures across Google Cloud Platform (GCP) face an overwhelming volume of configurations, identities, network paths, and vulnerability alerts. To make sense of this telemetry, organizations increasingly rely on advanced Cloud Native Application Protection Platforms (CNAPP) like Wiz. By establishing an agentless or lightly agented connection into the core telemetry planes of GCP, security teams gain deep visibility into risks spanning compute instances, serverless functions, container registries, and managed databases.

However, establishing this connection requires bridging two distinct access control paradigms. Google Cloud relies on a rigorous resource hierarchy governed by Identity and Access Management (IAM), Folders, and Organization nodes, while Wiz requires granular permissions to read configuration metadata, audit logs, and asset structures. Executing this integration securely in 2026 demands strict adherence to least-privilege principles, secure credential management, and continuous drift monitoring. This guide outlines the five essential steps required to build a resilient, secure integration between Google Cloud and Wiz.

Prerequisites and Architectural Overview

Before initiating the integration, cloud architects and security engineers must understand the underlying architecture. Wiz connects to Google Cloud primarily through API-driven discovery, utilizing service accounts deployed within a designated security project or at the organization level. This architecture minimizes operational overhead while ensuring comprehensive visibility across all child projects and folders.

The primary requirement is an active Google Cloud Organization with administrative access capable of creating custom IAM roles, deploying service accounts, and enabling foundational APIs. Additionally, administrators need access to the Wiz console with organization-level administrative privileges.

Core Architectural Requirements

• Dedicated Security Project: A standalone GCP project dedicated to housing Wiz integration resources, isolation boundaries, and audit logging.
• Organization-Level Access: The ability to grant custom roles at the root organization node (organizations/{ORG_ID}) or across specific folders to ensure scalable asset discovery.
• API Enablement: Active status for the Cloud Asset Inventory API, Cloud Resource Manager API, IAM Service Account Credentials API, and Compute Engine API across monitored projects.
• Network Security Paths: Conformance with outbound secure socket layer (SSL) requirements if routing traffic through custom Virtual Private Cloud (VPC) service controls or restricted firewalls.

Step 1: Create a Dedicated Security Project and Enable Required APIs

The foundation of a secure integration is proper segmentation. Rather than scattering integration assets across production application environments, organizations should provision a dedicated Google Cloud project—often named something like sec-wiz-integration-prod—under the root organization node or within a dedicated security folder.

This project will house the service accounts, configuration manifests, and any intermediate logging or storage resources required by the Wiz platform. Once the project is provisioned, you must enable the core APIs that allow Wiz to query resource metadata, inspect IAM policies, and map network topologies.

Executing API Enablement via Google Cloud CLI

To streamline the process, security engineers can use the Google Cloud CLI (gcloud) to provision the project and enable the necessary services in a single automated workflow. Run the following commands within your authenticated terminal:

# Set your target security project ID and Organization ID PROJECT_ID="sec-wiz-integration-prod" ORG_ID="123456789012" # Create the dedicated security project under your organization gcloud projects create $PROJECT_ID --organization=$ORG_ID # Link the project to your organization's billing account gcloud billing projects link $PROJECT_ID --billing-account=012345-678901-ABCDEF # Enable foundational APIs required for deep asset discovery gcloud services enable cloudresourcemanager.googleapis.com \ iam.googleapis.com \ cloudasset.googleapis.com \ compute.googleapis.com \ container.googleapis.com \ --project=$PROJECT_ID

Enabling these APIs grants Wiz the capability to query the Cloud Asset Inventory service, which acts as the central repository for GCP resource metadata. By querying Asset Inventory rather than querying individual services sequentially, Wiz minimizes API throttling and reduces the performance impact on your underlying workloads.

Step 2: Establish Least-Privilege Custom IAM Roles

A common pitfall during third-party security integrations is the over-assignment of permissions. Assigning broad primitive roles like roles/owner or roles/editor introduces severe security risks, as any compromised credential could grant an attacker full control over the entire cloud estate. Wiz operates securely by utilizing a granular set of read-only permissions designed to inspect configurations, examine container images, and review network pathways without altering state.

Instead of relying on broad predefined roles, you should construct a custom IAM role tailored precisely to the read requirements of the Wiz platform.

Defining the Custom Role Permissions

Create a YAML file named wiz-custom-role.yaml containing the exact permissions required for deep posture management:

title: "Wiz Read-Only Security Posture Role" description: "Custom IAM role granting Wiz read access to cloud assets, logs, and metadata." stage: "GA" includedPermissions: - resourcemanager.organizations.get - resourcemanager.folders.get - resourcemanager.projects.get - resourcemanager.projects.list - cloudasset.assets.searchAllResources - cloudasset.assets.searchAllIamPolicies - compute.instances.list - compute.disks.list - compute.networks.list - container.clusters.list - iam.roles.list - iam.serviceAccounts.list

Deploy this custom role to your Google Cloud organization using the following command:

gcloud iam roles create WizReadOnlyPosture \ --organization=$ORG_ID \ --file=wiz-custom-role.yaml

By scoping this role to the organization level (--organization=$ORG_ID), the permissions automatically cascade down to all current and future folders and projects, ensuring that Wiz automatically discovers newly provisioned infrastructure without manual re-configuration.

Step 3: Provision and Bind the Integration Service Account

With the custom role established, the next phase is creating the service account that Wiz will use to authenticate against Google Cloud APIs. This service account must reside within your dedicated security project (sec-wiz-integration-prod), but its IAM binding must be applied at the organization root.

This separation of duties ensures that the identity management lifecycle (key rotation, deletion, auditing) is managed inside your secure operations boundary, while the authorization scope spans the entire cloud environment.

Creating the Service Account and Binding Permissions

Execute the following commands to create the service account and assign the WizReadOnlyPosture role at the organization level:

# Define service account name SA_NAME="wiz-integration-sa" SA_EMAIL="$SA_NAME@$PROJECT_ID.iam.gserviceaccount.com" # Create the service account within the security project gcloud iam service-accounts create $SA_NAME \ --description="Service account for Wiz CSPP integration" \ --display-name="Wiz Integration SA" \ --project=$PROJECT_ID # Bind the custom role to the service account at the organization node gcloud organizations add-iam-policy-binding $ORG_ID \ --member="serviceAccount:$SA_EMAIL" \ --role="organizations/$ORG_ID/roles/WizReadOnlyPosture"

Managing Credentials Securely

Authentication between Google Cloud and Wiz can be handled via two primary methods: Google Cloud IAM Service Account Keys (JSON keys) or Workload Identity Federation.

• Service Account Keys: If using traditional JSON keys, you must ensure that key rotation policies are enforced every 90 days. Store the generated key securely within a dedicated secrets manager and upload it directly into the Wiz portal through encrypted channels.
• Workload Identity Federation: For organizations seeking keyless architectures, configure Workload Identity Federation to allow Wiz to assume the service account via OpenID Connect (OIDC) tokens, eliminating the need to manage static credentials altogether.

Step 4: Configure Cloud Asset Inventory Feeds and Real-Time Telemetry

While periodic API polling provides a solid baseline for posture management, modern cloud security demands near real-time visibility into infrastructure changes. When a developer spins up an unencrypted storage bucket or opens an unauthorized firewall port, security teams need immediate notification.

Google Cloud Asset Inventory supports continuous exporting of resource changes to Cloud Pub/Sub, which Wiz can consume to ingest updates instantly.

Setting Up Pub/Sub Integration

1. Create a Pub/Sub Topic: In your security project, create a dedicated topic named wiz-asset-feed-topic.
2. Configure Asset Feeds: Set up an asset feed that targets the organization root and forwards resource metadata mutations to the Pub/Sub topic.
3. Grant Wiz Consumer Access: Grant the Wiz service account permissions to consume messages from the Pub/Sub subscription (roles/pubsub.subscriber).

# Create the Pub/Sub topic gcloud pubsub topics create wiz-asset-feed-topic --project=$PROJECT_ID # Create an asset feed exporting updates to the topic gcloud asset feeds create wiz-org-feed \ --organization=$ORG_ID \ --asset-types="compute.googleapis.com/Instance,storage.googleapis.com/Bucket,container.googleapis.com/Cluster" \ --content-type="resource" \ --pubsub-topic="projects/$PROJECT_ID/topics/wiz-asset-feed-topic"

This streaming pipeline ensures that Wiz maintains a synchronized, up-to-the-second graph of your Google Cloud environment without waiting for scheduled batch scans.

Step 5: Validate Integration and Verify Posture Dashboard

The final step involves linking the configured credentials within the Wiz console and executing validation checks to ensure telemetry flows accurately without permission errors or API rate-limiting blocks.

Log in to the Wiz portal, navigate to Cloud Accounts, and select Google Cloud. Input your Organization ID, designate the security project ID, and upload your service account credentials (or finalize your Workload Identity Federation trust parameters). Once saved, Wiz initiates an initial discovery scan.

Post-Integration Verification Checklist

• Resource Count Reconciliation: Compare the total number of Virtual Machine instances, Kubernetes clusters, and storage buckets reported by Wiz against your Google Cloud Billing and Asset Inventory dashboards to ensure 100% coverage.
• IAM Permission Audit: Review Google Cloud Cloud Logging to verify that Wiz API calls are completing successfully with 200 OK responses and that no PERMISSION_DENIED errors are logged against critical resources.
• Scan Latency Check: Trigger a test resource creation (such as a temporary test bucket) and measure the time it takes for Wiz to detect the new asset via the Pub/Sub feed.
• Remediation Testing: Verify that alerting rules correctly trigger notifications to your Security Operations Center (SOC) or SIEM platform of choice.

Common Integration Pitfalls and Troubleshooting

Even with careful planning, administrators may encounter edge cases during the deployment lifecycle. Addressing these proactive failure modes ensures operational continuity.

Resolving API Throttling and Quota Exhaustion

In massive multi-project enterprise deployments, initial Wiz scans can trigger Google Cloud API rate limits. If you observe RESOURCE_EXHAUSTED errors in your Cloud Logging console, submit a quota increase request for the Cloud Asset Inventory API and Compute Engine API through the Google Cloud Console. Additionally, configure Wiz scan throttling settings to pace API requests across non-peak operational windows.

Handling Inherited IAM Denials

Google Cloud IAM denials can occur if explicit organization policies or folder-level constraints block read access to specific sensitive projects (such as PCI or HIPAA compliance boundaries). Ensure that folder-level deny policies do not inadvertently override the WizReadOnlyPosture role assigned at the organization root. If specific projects require isolation, provision dedicated service accounts scoped strictly to those individual project boundaries rather than relying solely on the root organization binding.

Frequently Asked Questions

What level of access does Wiz require in Google Cloud?

Wiz requires read-only access to resource configurations, metadata, audit logs, and asset inventories. It does not require administrative write access or permissions to modify workloads unless users explicitly configure automated remediation features, which are strictly opt-in.

Is an agent required on Google Cloud virtual machines for Wiz to work?

No. Wiz utilizes an agentless architecture that snapshots block storage volumes out-of-band and scans them for vulnerabilities, malware, and sensitive data. However, optional lightweight runtime sensors can be deployed on Kubernetes clusters or GKE nodes for real-time threat detection.

How often does Wiz scan Google Cloud environments?

By default, Wiz performs continuous discovery via Cloud Asset Inventory feeds and Pub/Sub event streaming, supplemented by deep resource graph scans executed multiple times per day.

Can I restrict Wiz integration to specific GCP folders instead of the entire organization?

Yes. While organization-level integration is recommended for comprehensive visibility, you can scope the IAM role binding to specific folders or individual projects if your governance model requires strict isolation between business units.

How are credentials handled between GCP and Wiz?

Credentials are encrypted both in transit (via TLS 1.3) and at rest within the Wiz platform. Organizations can choose between traditional rotated JSON service account keys or modern keyless authentication using Workload Identity Federation.

Conclusion and Next Actions

Integrating Wiz with Google Cloud provides security teams with deep, graph-based visibility into modern multi-project cloud architectures. By carefully provisioning a dedicated security project, enforcing strict least-privilege custom IAM roles, streaming real-time telemetry via Pub/Sub, and validating asset ingestion pipelines, organizations can achieve robust cloud posture management without compromising infrastructure stability.

To maintain this security posture, establish a recurring operational review cadence to audit service account permissions, verify key rotation schedules, and review IAM policy drift across your Google Cloud organization.