Skip to main content

​
GCP Connector

Flare connects to GCP via OAuth to read your Cloud Audit Logs. The connection is read-only - Flare cannot modify your GCP resources.

​
What Flare accesses

Core access with roles/logging.viewer covers the standard audit streams available to that role. Data Access is an optional, higher-volume stream with an additional permission requirement.

​
Required permissions

For core audit analysis, the Google account you authenticate with needs this IAM role on the GCP project:
This is a read-only role. It allows Flare to list and read standard log entries but not modify anything. It does not grant access to Data Access entries in the _Default log bucket. For Data Access analysis, the account also needs:
Alternatively, an administrator can grant access to a narrowly filtered, customer-created log view. Advanced log-view support is on Flare’s analytics roadmap and is not required for core analysis.
To check your permissions, go to the GCP Console IAM page, find your account, and verify Logs Viewer or roles/logging.viewer is listed.

​
Granting access

If you don’t have roles/logging.viewer, ask your GCP admin to run:
If you intentionally want Flare to analyze Data Access logs, your administrator can separately grant:
Grant private-log access only when needed. Data Access logs must also be enabled for the relevant services, and enabling them can increase Cloud Logging volume and cost.

​
Connecting

  1. Go to Connectors in Flare
  2. Select Google Cloud Platform
  3. Click Connect with Google
  4. Sign in with your Google account on Google’s OAuth consent screen
  5. Grant Flare access to read your Cloud Audit Logs
After connecting, Flare shows your Google email and the connection date.

​
OAuth scopes

Flare requests a single OAuth scope: Flare does not request write, admin, or billing scopes.

​
Finding your GCP Project ID

When running an analysis, you’ll need your GCP Project ID. To find it:
  1. Open the GCP Console
  2. Click the project selector dropdown at the top of the page
  3. Your Project ID is shown in the ID column (e.g., my-project-123)
The Project ID is different from the Project Name. The ID is the lowercase, hyphenated identifier (e.g., flare-prod-2026), not the display name.

​
Token refresh

Flare automatically refreshes your OAuth token when it expires. You don’t need to reconnect manually unless:
  • You revoke Flare’s access in your Google Account permissions
  • Your Google account password changes and invalidates active sessions
  • Your GCP organization enforces session policies that expire OAuth tokens

​
Reconnecting

If your connection expires or is revoked, Flare shows the connector status as Expired with a red indicator. To reconnect:
  1. Go to Connectors
  2. Click Reconnect GCP
  3. Complete the Google OAuth flow again
Your analysis history is preserved - only the live connection needs to be re-established.

​
Disconnecting

To remove your GCP connection:
  1. Go to Connectors
  2. Click Disconnect below the connected status
This removes the OAuth tokens from Flare. Your analysis history is not deleted.

​
Troubleshooting

Confirm the correct Project ID and roles/logging.viewer for core audit logs. If the failure is limited to Data Access logs, confirm that category is enabled and the account has roles/logging.privateLogViewer or access to the selected log view.
Your OAuth token was revoked or expired. Click Reconnect GCP on the Connectors page to re-authenticate.
Verify the Project ID and try a wider time window. Admin Activity logs are always on, but Data Access logs may need to be explicitly enabled and require private-log access. A successful core connection alone does not confirm Data Access coverage.
Verify the Project ID matches the project where your workloads run. Also try a wider time window - if there’s little activity, “Last 1h” may return zero logs.
Need more help? Visit Flare Support and include the Project ID, connector status, and exact error message. Never send OAuth tokens or account credentials.