Google Cloud KMS Setup Guide for CBOM GCP Discovery Sensor
PART 1: GCP SETUP (From scratch)
1.1. Create a GCP Project
At the top, click the project selector dropdown.
Click "New Project".
Enter: Project name:
cbomBilling account: Must be set up (free tier is fine)Click Create.
Once created, select the new project.
1.2. Enable APIs
Navigate to: https://console.cloud.google.com/apis/library
Enable the following APIs for the project:
| API Name | Description |
|---|---|
| Cloud KMS API | Required for key management |
| IAM API | Required to manage service roles |
Click “Enable” on each.
1.3. Create a Key Ring & Key
In GCP Console or with gcloud:
Using GCP Console:
Go to: Security > Key Management > Key Rings
Click "Create Key Ring" Name:
test-key-ringLocation:globalClick "Create Key" Name:
test-asym-keyKey Purpose:Asymmetric SignAlgorithm:RSA_SIGN_PKCS1_2048_SHA256Protection Level:Software(or HSM if available)
Alternatively, via gcloud CLI:
gcloud kms keyrings create test-key-ring --location global
gcloud kms keys create test-asym-key \
--location global \
--keyring test-key-ring \
--purpose asymmetric-signing \
--default-algorithm rsa-sign-pkcs1-2048-sha256PART 2: IAM & AUTHENTICATION
2.1. Create a Service Account
Go to: IAM & Admin > Service Accounts
Click “Create Service Account” Name:
cbom-kms-readerID: auto-filled * Description:Used for CBOM GCP discoveryClick Create and Continue
Grant roles:
Cloud KMS Viewer(optional)Secret Manager Viewerif you want to add certs laterClick Done
2.2. Create & Download JSON Key
In the service account list, click the 3 dots → Manage keys
Click “Add Key” → “Create new key”
Select JSON and click Create
Save the key file (e.g.
cbom-sa-key.json) securely
PART 3: LOCAL PYTHON SETUP
3.1. Install Python Packages
pip install google-cloud-kms cryptography3.2. Prepare Your CBOM Config
ConfigExample.yaml:
ExtName: Discover_GCPKMS
project_id: "cbom-468113"
location_id: "global"
key_ring_id: "test-key-ring"
Use GOOGLE_APPLICATION_CREDENTIALS environment variable (Recommended)
-
Locate your downloaded service account JSON key — e.g.:
C:\CBOM-Services\creds\cbom-468113-5dd33f609a00.json -
Open Command Prompt (or PowerShell) and run: #### For Command Prompt:
set GOOGLE_APPLICATION_CREDENTIALS=C:\CBOM-Services\creds\cbom-468113-5dd33f609a00.json#### For PowerShell:
$env:GOOGLE_APPLICATION_CREDENTIALS="C:\CBOM-Services\creds\cbom-468113-5dd33f609a00.json" Then rerun your CBOM discovery task.
This environment variable must be set in the same session that runs your Python or CBOM task, unless you persist it.
Optional: Persist environment variable (Windows)
If you want to make it permanent:
Search for
Environment Variablesin the Start Menu.Under System Properties > Environment Variables: Click New (in User or System variables) Name:
GOOGLE_APPLICATION_CREDENTIALS* Value:C:\CBOM-Services\creds\cbom-sa-key.jsonClick OK, apply changes.
Restart your Command Prompt or system.