Google Cloud Service Account Setup

GOOGLE CLOUD ADMIN

Relationship Intelligence uses a tenant-specific Google service account to request authorized, read-only access to Google Workspace directory and Gmail metadata APIs.

Complete these steps before configuring Domain-Wide Delegation or entering the Google Workspace provider in EIE.

Before you begin

• Access to the customer's Google Cloud organization or approved Google Cloud project
• Permission to create or manage Google Cloud projects
• Permission to enable APIs
• Permission to create service accounts and service-account keys
• Google Workspace Super Admin access for Domain-Wide Delegation
• Access to the correct customer tenant in EIE
• A designated Google Workspace admin mailbox
• A mailbox that can be used for connection testing

1. Create or select a Google Cloud project

1. Sign in to the Google Cloud Console: https://console.cloud.google.com/↗
2. Open the project selector.
3. Select an existing customer-approved project, or create a dedicated project.
4. Use a recognizable project name such as:

Real Intelligence Relationship Intelligence

Record the following:

Confirm that the project is active and not scheduled for deletion.

Some Google organizations may require billing or additional organization-policy approval before APIs or service-account keys can be enabled.

2. Enable the required Google APIs

In the selected Google Cloud project:

1. Open APIs & Services → Library.
2. Search for Admin SDK API.
3. Open it and select Enable.
4. Return to the API Library.
5. Search for Gmail API.
6. Open it and select Enable.
7. Open APIs & Services → Enabled APIs & services.
8. Confirm both APIs appear as enabled.

Relationship Intelligence does not require an OAuth consent-screen flow for individual users. Authorization is performed through a service account and Google Workspace Domain-Wide Delegation.

3. Create the Relationship Intelligence service account

1. Open IAM & Admin → Service Accounts.
2. Select Create service account.
3. Enter a descriptive name:

Relationship Intelligence

1. Use the recommended service-account ID:

relationship-intelligence

1. Use the recommended description:

Tenant-specific service account used by Real Intelligence Relationship Intelligence for authorized read-only Google Workspace directory and Gmail metadata access.

1. Select Create and continue.
2. Do not assign broad Google Cloud project roles unless specifically required by the customer's security policy.
3. Complete the service-account creation.

4. Enable Google Workspace Domain-Wide Delegation

1. Open the newly created service account.
2. Open its details or advanced settings.
3. Locate Domain-wide delegation.
4. Enable Google Workspace Domain-wide Delegation.
5. If requested, enter a product name such as Real Intelligence Relationship Intelligence.
6. Save the service account.
7. Copy and securely record the service account's numeric OAuth 2 Client ID.

Example format only (not a real credential):

123456789012345678901

5. Create the service-account JSON credential

1. Open the service account.
2. Select the Keys tab.
3. Select Add key → Create new key.
4. Choose JSON.
5. Select Create.
6. Google downloads the credential file to the administrator's computer.
7. Do not rename, edit, email, or paste the credential into an unapproved system.
8. Continue directly to the EIE upload step.

The EIE interface should mask the JSON credential after it is saved and should never display the private key again.

If "Create new key" is unavailable

Google Cloud organizations may enforce an organization policy that prevents service-account key creation.

Possible causes include:

• iam.disableServiceAccountKeyCreation is enforced
• The administrator lacks permission to create service-account keys
• The project is governed by a centralized security policy
• Additional approval is required for persistent credentials

Recommended response:

1. Do not attempt to bypass the organization's security policy.
2. Contact the customer's Google Cloud or security administrator.
3. Explain that the current EIE Google provider requires a tenant-specific service-account credential.
4. Request an approved project-level exception only if allowed by the customer's security policy.
5. Document who approved the exception.

If the customer will not permit JSON credentials, contact Real Intelligence to determine whether a keyless authentication option is available.

6. Configure the Google Workspace provider in EIE

EIE → Connected Systems → Google Workspace

Workspace Domain — use the customer's primary Google Workspace domain, not an alias domain unless the tenant configuration explicitly requires it.

Workspace Admin Subject — use an active Google Workspace account authorized for the required directory operations. This is the user identity the service account impersonates for directory calls.

Test Mailbox — use an active mailbox that the administrator is authorized to test. The test verifies Gmail metadata access without importing message bodies.

After saving, EIE should:

• Display the service-account email
• Display the numeric OAuth Client ID
• Display credential status
• Never redisplay the private key

Continue to Google Workspace Configuration to authorize the Client ID and scopes in Google Admin Console.

Credential lifecycle

Credential rotation

1. Create a replacement JSON key for the same service account.
2. Update the Google Workspace provider in EIE.
3. Run EIE verification.
4. Run Salesforce Verify Google Connection.
5. Confirm active discovery jobs are operating normally.
6. Disable the previous key.
7. Monitor for failures.
8. Delete the previous key after the approved overlap period.

Credential revocation

If a credential may have been exposed:

1. Disable or delete the affected key immediately in Google Cloud Console.
2. Pause Relationship Intelligence discovery for the tenant.
3. Create and upload a replacement credential.
4. Run EIE and Salesforce verification.
5. Review Google Cloud and EIE audit records.
6. Record the incident under the customer's security procedure.

Last updated 1 month ago