The CloudQuery Google Workspace plugin pulls data from Google Workspace and loads it into any supported CloudQuery destination
Publisher
cloudquery
Latest version
v1.3.6
Type
Source
Platforms
Date Published
Loading plugin documentation
CloudQuery's use of cookies
We use tracking cookies to understand how you use the product and help us improve it. Your consent is required before we can enable these cookies. You can opt out via the link in the footer.
gcloud iam workload-identity-pools create "my-pool" \
--project="PROJECT_ID" \
--location="global" \
--display-name="My Pool"
gcloud iam workload-identity-pools providers create-aws example-provider \
--location="global" \
--workload-identity-pool="my-pool" \
--account-id="123456789000" \
--attribute-mapping="google.subject=assertion.arn,attribute.account=assertion.account,attribute.aws_role=assertion.arn.extract('assumed-role/{role}/'),attribute.aws_ec2_instance=assertion.arn.extract('assumed-role/{role_and_session}').extract('/{session}')" \
--project="PROJECT_ID"
gcloud iam workload-identity-pools providers create-oidc "my-provider" \
--project="PROJECT_ID" \
--location="global" \
--issuer-uri="https://sts.windows.net/AZURE_TENANT_ID" \
--workload-identity-pool="my-pool" \
--display-name="My Azure Provider" \
--tenant-id="AZURE_TENANT_ID"
gcloud iam service-accounts add-iam-policy-binding "my-sa@MY_PROJECT.iam.gserviceaccount.com" \
--project="PROJECT_ID" \
--role="roles/iam.workloadIdentityUser" \
--member="principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/attribute.aws_role/ROLE_NAME"
gcloud iam service-accounts add-iam-policy-binding "my-sa@MY_PROJECT.iam.gserviceaccount.com" \
--project="PROJECT_ID" \
--role="roles/iam.workloadIdentityUser" \
--member="principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/attribute.azure_tenant_id/AZURE_TENANT_ID"
gcloud iam workload-identity-pools create-cred-config "projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/my-provider" \
--service-account="my-sa@MY_PROJECT.iam.gserviceaccount.com" \
--output-file="credentials.json" \
--aws \
--project="PROJECT_ID"
gcloud iam workload-identity-pools create-cred-config "projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/my-provider" \
--service-account="my-sa@MY_PROJECT.iam.gserviceaccount.com" \
--output-file="credentials.json" \
--azure \
--project="PROJECT_ID"
GOOGLE_APPLICATION_CREDENTIALS environment variable.oauth or service_account configuration in the plugin spec when using Workload Identity Federation.GOOGLE_CLOUD_AUTH_LOGGING to true.AWS_PROFILE, AWS_SDK_LOAD_CONFIG=1, and AWS_EC2_METADATA_DISABLED=true as AWS IMDS won't be available. # credentials_json: "${file:./path-to-service-account-credentials.json}"
https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly,https://www.googleapis.com/auth/admin.directory.device.mobile.readonly,https://www.googleapis.com/auth/admin.directory.domain.readonly,https://www.googleapis.com/auth/admin.directory.group.member.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.orgunit.readonly,https://www.googleapis.com/auth/admin.directory.resource.calendar.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.user.security,https://www.googleapis.com/auth/admin.directory.userschema.readonlykind: source
spec:
name: googleworkspace
path: cloudquery/googleworkspace
version: "v1.3.6"
tables: ["*"]
destinations: ["postgresql"]
spec:
customer_id: "my-customer-id"
oauth:
client_id: "${GOOGLEWORKSPACE_CLIENT_ID}"
client_secret: "${GOOGLEWORKSPACE_CLIENT_SECRET}"
# # Alternatively, you can use service account credentials JSON.
# service_account:
# # The credentials JSON of the service account.
# credentials_json: "${file:./path-to-service-account-credentials.json}"
# # The email of the admin user to impersonate.
# impersonate_email: "[email protected]"
# # Optional: Retry configuration for transient errors (including HTTP 403, 429, 5xx).
# retry_max: 4 # Maximum number of retries (default: 4).
# retry_wait_min_seconds: 1 # Minimum seconds to wait between retries (default: 1).
# retry_wait_max_seconds: 30 # Maximum seconds to wait between retries (default: 30).
customer_id (string) (required)
The customer ID of the Google Workspace account to sync data from.oauth (OAuth Spec) (required if service_account is not set)
OAuth spec for authorization in Google Workspace.service_account (Service Account Spec) (required if oauth is not set)
Service account spec.concurrency (int) (optional) (default: 10000)
The concurrency level for the plugin.retry_max (int) (optional) (default: 4)
Maximum number of retries for a request that fails due to a transient error (HTTP 403, 429, 5xx, or connection error).retry_wait_min_seconds (int) (optional) (default: 1)
Minimum number of seconds to wait before retrying a failed request.retry_wait_max_seconds (int) (optional) (default: 30)
Maximum number of seconds to wait before retrying a failed request.client_id (string) (required)
The client ID of the OAuth client.client_secret (string) (required)
The client secret of the OAuth client.cached_token_file_path (string) (optional)
Path to a cached token file. If set, the plugin will use the cached token instead of opening a browser window for authentication.credentials_json (string) (required)
The credentials JSON of the service account.impersonate_email (string) (required)
The email of the admin user to impersonate.