# Google Cloud

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2F4VtRnfVTpNtY00imNxhr%2FGoogle%20Cloud%20rotation.jpg?alt=media&#x26;token=5773058f-1e65-4abe-864e-9770b17783c5" alt=""><figcaption></figcaption></figure>

## Overview

In this section, you will learn how to rotate user credentials within the Google Cloud environment across various target systems and services.

## KeeperPAM Record Types

Configurations for your GCP environment are defined in the PAM Configuration section of Keeper Secrets Manager.  Keeper will use the inherited service account where the Gateway is installed to authenticate with the GCP system and perform rotation.&#x20;

Configurations for managed resources like Compute Engine, Cloud SQL, and Managed Microsoft AD are defined in the [PAM Machine](https://docs.keeper.io/en/keeperpam/privileged-access-manager/getting-started/pam-resources/pam-machine), [PAM Database](https://docs.keeper.io/en/keeperpam/privileged-access-manager/getting-started/pam-resources/pam-database), and [PAM Directory](https://docs.keeper.io/en/keeperpam/privileged-access-manager/getting-started/pam-resources/pam-directory) record types. The following table shows the supported AWS managed resources with KeeperPAM and their corresponding PAM Record Type:

<table><thead><tr><th width="267">Google Managed Resource</th><th>Corresponding Record Type</th></tr></thead><tbody><tr><td>Compute Engine VM</td><td>PAM Machine</td></tr><tr><td>Cloud SQL Instance</td><td>PAM Database</td></tr><tr><td>Managed Microsoft AD</td><td>PAM Directory</td></tr><tr><td>Google Workspace Principal</td><td>PAM User</td></tr></tbody></table>

Configurations for directory users, database users, or VM users are defined in the [PAM User](https://docs.keeper.io/en/keeperpam/privileged-access-manager/getting-started/pam-resources/pam-user) record type.&#x20;

## Prerequisites

To successfully rotate Compute Cloud Resource User accounts or Google Workspace Principal accounts, the Keeper Gateway needs to have the necessary service account with the permissions for performing the password rotation.&#x20;

* See the [Google Cloud environment setup guide](https://docs.keeper.io/en/keeperpam/privileged-access-manager/getting-started/pam-configuration/google-cloud-environment-setup) for more information.

## Setup Steps&#x20;

At a high level, the following steps are needed to successfully rotate passwords on your Google Cloud network:

1. Create Shared Folders to hold the PAM records involved in rotation&#x20;
2. Create PAM Machine, PAM Database and PAM Directory records representing each resource
3. Create PAM User records that contain the necessary account credentials for each resource
4. Link the PAM User record to the PAM Resource record.
5. Assign a Secrets Manager Application to all of the shared folders that hold the PAM records
6. Install a Keeper Gateway and add it to the Secrets Manager application
7. Create a PAM Configuration with the GCP environment setting
8. Configure Rotation settings on the PAM User records

### Use Cases

* [IAM User Password](https://docs.keeper.io/en/keeperpam/privileged-access-manager/password-rotation/rotation-use-cases/aws/iam-user)
* [Managed Microsoft AD User](https://docs.keeper.io/en/keeperpam/privileged-access-manager/password-rotation/rotation-use-cases/aws/directory-user)
* [EC2 Instance local user](https://docs.keeper.io/en/keeperpam/privileged-access-manager/password-rotation/rotation-use-cases/aws/ec2-virtual-machine-user)
* [IAM User Access Key](https://docs.keeper.io/en/keeperpam/privileged-access-manager/password-rotation/rotation-use-cases/aws/iam-user-access-key)
* [Managed Database](https://docs.keeper.io/en/keeperpam/privileged-access-manager/password-rotation/rotation-use-cases/aws/managed-database)