GCP
The GCP integration connects your Google Cloud Platform environment to Sprigr Teams. Its single gcp tool spans Compute Engine, Cloud Functions, Cloud Storage, Cloud Run, BigQuery, Cloud Monitoring and Logging, billing, IAM, and GKE — so your agents can answer questions about your infrastructure, check resource status, and assist with routine cloud operations.
Permission tiers
Section titled “Permission tiers”When you connect GCP, you choose a permission tier:
- Read-Only Monitoring — Agents can list and describe resources, run BigQuery queries, read metrics and logs, and query billing, but cannot change anything.
- Full Management — Adds write actions such as starting and stopping instances, invoking functions, and uploading or deleting storage objects.
The tier you select in Sprigr Teams should match the IAM roles granted to the service account. You can also restrict the integration to specific regions and services.
Prerequisites
Section titled “Prerequisites”- An active Google Cloud Platform project with the resources you want agents to access.
- Permission to create service accounts and manage IAM roles in your GCP project.
- Admin or Owner role in your Sprigr Teams organisation.
How authentication works
Section titled “How authentication works”The GCP integration uses a service account for authentication. You create a service account in your GCP project, grant it the permissions your agents need, and provide the JSON key to Sprigr Teams. This approach gives you full control over what your agents can access:
- You define the exact IAM roles assigned to the service account
- You can revoke access at any time by deleting the key or the service account
- All actions are logged in your GCP audit logs
Connecting GCP
Section titled “Connecting GCP”-
Create a service account in GCP
Open the Google Cloud Console and navigate to IAM & Admin > Service Accounts. Click Create Service Account.
- Name — Give it a descriptive name like “sprigr-teams-integration”
- Description — “Service account for Sprigr Teams agent access”
- Click Create and Continue
-
Assign IAM roles
Grant the service account the roles it needs. For read-only access across common services, assign:
- Compute Viewer — For Compute Engine instance queries
- Cloud Functions Viewer — For Cloud Functions information
- Storage Object Viewer — For Cloud Storage access
- Cloud Run Viewer — For Cloud Run service queries
- BigQuery Data Viewer — For BigQuery table and dataset queries
- Monitoring Viewer — For Cloud Monitoring metrics
- Logs Viewer — For Cloud Logging access
- Billing Account Viewer — For billing information
- Kubernetes Engine Cluster Viewer — For GKE cluster information
Click Continue, then Done.
-
Download the JSON key
From the service accounts list, click on the newly created account. Go to the Keys tab, click Add Key > Create new key, select JSON, and click Create.
A JSON key file will download to your computer. Keep this file secure — it grants access to your GCP project.
-
Open the Integration Hub
Sign in to team.sprigr.com and click Integrations in the sidebar.
-
Find GCP
Locate the GCP card and click Connect. This opens the GCP setup wizard.
-
Paste the JSON key
Open the downloaded JSON key file in a text editor, copy the entire contents, and paste it into the setup wizard’s key field.
-
Test the connection
Click Test Connection. Sprigr Teams will use the service account to make a basic API call to verify that everything works. If successful, click Save to complete the setup.
Available actions
Section titled “Available actions”The GCP integration is a single gcp tool that takes an action parameter. Write actions (marked below) require the Full Management permission tier.
Compute Engine
Section titled “Compute Engine”| Action | Description |
|---|---|
compute_list_instances | List Compute Engine instances with optional filters |
compute_describe_instance | Get detailed information about a specific instance |
compute_start_instance | Start a stopped instance (write) |
compute_stop_instance | Stop a running instance (write) |
compute_reset_instance | Reset an instance (write) |
compute_get_serial_port | Read an instance’s serial port output |
Cloud Functions
Section titled “Cloud Functions”| Action | Description |
|---|---|
functions_list | List Cloud Functions |
functions_describe | Get details about a specific function |
functions_get_logs | View recent function execution logs |
functions_invoke | Invoke a Cloud Function (write) |
functions_update_config | Update a function’s configuration (write) |
Cloud Storage
Section titled “Cloud Storage”| Action | Description |
|---|---|
storage_list_buckets | List Cloud Storage buckets |
storage_list_objects | List objects in a bucket |
storage_get_object | Read an object from Cloud Storage |
storage_upload_object | Upload an object to Cloud Storage (write) |
storage_delete_object | Delete an object from Cloud Storage (write) |
Cloud Run
Section titled “Cloud Run”| Action | Description |
|---|---|
run_list_services | List Cloud Run services |
run_describe_service | Get details about a specific Cloud Run service |
run_list_revisions | List revisions of a Cloud Run service |
run_get_logs | View logs for a Cloud Run service |
BigQuery
Section titled “BigQuery”| Action | Description |
|---|---|
bigquery_list_datasets | List BigQuery datasets |
bigquery_list_tables | List tables in a dataset |
bigquery_run_query | Run a BigQuery SQL query |
bigquery_get_job_results | Retrieve the results of a query job |
Cloud Monitoring and Logging
Section titled “Cloud Monitoring and Logging”| Action | Description |
|---|---|
monitoring_get_metrics | Query Cloud Monitoring metrics |
monitoring_list_alert_policies | List alerting policies |
monitoring_list_uptime_checks | List uptime checks |
logging_query_logs | Search Cloud Logging entries |
logging_list_log_names | List available log names |
Billing
Section titled “Billing”| Action | Description |
|---|---|
billing_get_info | Get billing account information |
billing_list_budgets | List configured budgets |
billing_get_costs | Get cost data broken down by service |
| Action | Description |
|---|---|
iam_list_service_accounts | List service accounts in the project |
iam_list_roles | List IAM roles |
iam_get_policy | Get IAM policy bindings for a resource |
iam_get_project_info | Get project-level information |
GKE (Kubernetes Engine)
Section titled “GKE (Kubernetes Engine)”| Action | Description |
|---|---|
gke_list_clusters | List GKE clusters |
gke_describe_cluster | Get detailed information about a specific cluster |
gke_list_workloads | List workloads running in a cluster |
Common use cases
Section titled “Common use cases”- Infrastructure status checks — “What Compute Engine instances are running in production?” — An agent queries your instances and returns a summary of names, states, machine types, and zones.
- Cost monitoring — “What are our top GCP costs this month?” — The agent retrieves billing data and presents a breakdown by service, highlighting any unexpected increases.
- Log investigation — “Show me errors from the payments Cloud Function in the last hour” — The agent queries Cloud Logging and returns matching entries with timestamps and error details.
- BigQuery analysis — “How many orders were placed last week?” — The agent runs a BigQuery query against your data warehouse and returns the results.
- GKE cluster health — “What’s the status of our production Kubernetes cluster?” — The agent describes the cluster and lists the workloads running in it.
- Automated monitoring reports — A scheduled workflow queries metrics, alerts, and billing data each morning and sends a summary to your engineering channel.
Troubleshooting
Section titled “Troubleshooting”“Permission denied” errors The service account is missing the required IAM role for the resource or service being accessed. Add the appropriate Viewer or Admin role in the GCP IAM console.
“Service account key is invalid”
Make sure you copied the entire JSON key contents, including the opening and closing braces. The key should start with { and end with }.
Cannot access resources in a different project The service account is scoped to the project where it was created. To access resources in another project, grant the service account cross-project permissions in the target project’s IAM settings.
BigQuery queries timing out Complex or large-scale queries may exceed the default timeout. Consider optimising the query or breaking it into smaller parts.
Cloud Logging returning empty results Check that the log filter is correct and that the date range includes the time period you are looking for. Also verify that logging is enabled for the service in question.
Next steps
Section titled “Next steps”- AWS — Connect Amazon Web Services alongside or instead of GCP.
- Integrations Overview — See all available integrations.
- Workflows — Automate infrastructure monitoring and reporting with workflows.