Merge branch 'main' into tcarter-O11YDOCS-6542-AI-GA

Author: Tracey Carter

gdi/get-data-in/connect/gcp/gcp-connect.rst

@@ -44,21 +44,7 @@ To configure your GCP service:
 
 #. Log into your GCP account and select the project you want to monitor in the GCP web console.
 
-#. From the sidebar, select :menuselection:`IAM & admin`, then :menuselection:`Service Accounts`.
-
-#. Go to :guilabel:`Create Service Account` at the top of the screen, complete the following fields, and select :guilabel:`CREATE`.
-
-   * **Service account name**. Enter ``Splunk``.
-
-   * **Service account ID**. This field autofills after you enter ``Splunk`` for Service account name.
-
-   * **Service account description**. Enter the description for your service account.
-
-#. (Optional) Select a role to grant this Service account access to the selected project, then select :guilabel:`CONTINUE`.
-
-#. Activate Key type :guilabel:`JSON`, and select :guilabel:`CREATE`. A new service account key JSON file is then downloaded to your computer. You will need this key to authenticate in Splunk Observability Cloud.
-
-#. In a new window or tab, go to :new-page:`Cloud Resource Manager API <https://console.cloud.google.com/apis/library/cloudresourcemanager.googleapis.com?pli=1>`, and activate the Cloud Resource Manager API. You need to activate this API so Splunk Observability Cloud can use it to validate permissions on the service account keys.
+#. Authenticate your GCP project using Workload Identity Federation or Service Account Keys. For more details, see :ref:`gcp-prereqs-authenticate`.
 
 .. _gcp-projects:
 
@@ -85,7 +71,7 @@ By default, Splunk Observability Cloud monitors all supported services, and any
 
   * Name. Type in the name of the GCP integration.
 
-  * Project. Select :guilabel:`Add Project`, next select :guilabel:`Import Service Account Key` and import one or more of the JSON key files that you downloaded from GCP in :ref:`Configure GCP <gcp-two>`.
+  * Project. Select :guilabel:`Add Project` to add a new project and follow the prompts to authenticate it. For more details, see :ref:`gcp-prereqs-authenticate`.
 
   * Services. By default the new integration syncs with all supported GCP services. Select :guilabel:`All services > Sync only selected services` to select specific services to sync with.  
 

gdi/get-data-in/connect/gcp/gcp-prereqs.rst

@@ -14,22 +14,48 @@ Prerequisites
 
 You must be an administrator of your Splunk Observability Cloud organization to create a GCP connection.
 
+.. _gcp-prereqs-authenticate:
+
 Authenticate your Google account 
 ============================================
 
-You need your service account keys to be able to integrate your GCP services with Splunk Observability Cloud. Check the restrictions on your organization's account keys before connecting to Splunk Observability Cloud. 
+Authenticate using Workload Identity Federation (recommended)
+--------------------------------------------------------------------------------------
+
+Use Workload Identity Federation (WIF) to authenticate your GCP account in Splunk Observability Cloud. It's safer, and with WIF you won't have to export and rotate service account keys.
+
+To set up Workload Identity Federation to authenticate Splunk Observability Cloud to access your GCP Cloud Monitoring data take these steps: 
 
-For more information, refer to: 
+#. Follow the instructions in the :new-page:`Workload Identity Federation Setup Utils <https://github.com/signalfx/gcp_workload_identity_federation>` GitHub repo.
 
-* GCP's docs on :new-page:`Service account keys <https://cloud.google.com/iam/docs/service-account-creds#key-types>` 
-* Google's official announcement on the new permission policies at :new-page:`Introducing stronger default Org Policies for our customers <https://cloud.google.com/blog/products/identity-security/introducing-stronger-default-org-policies-for-our-customers/>`
+#. Run the :new-page:`Workload Identity Federation Setup Script <https://github.com/signalfx/gcp_workload_identity_federation/blob/main/cli/README.md>` or use the :new-page:`Terraform Setup Module <https://github.com/signalfx/gcp_workload_identity_federation/blob/main/terraform/README.md>`.
 
-Authenticate using Workload Identity Federation
+To learn more refer to GCP's :new-page:`Workload Identity Federation <https://cloud.google.com/iam/docs/workload-identity-federation>` documentation.
+
+Authenticate using Service Account Keys
 --------------------------------------------------------------------------------------
 
-Alternatively, if you're connecting to Splunk Observability Cloud using the API you can use :new-page:`GCP's Workload Identity Federation (WIF) <https://cloud.google.com/iam/docs/workload-identity-federation>` to access your Google Cloud resources and authenticate them. It's safer, and with WIF you won't have to export and rotate service account keys.
+Alternatively you can use your service account keys to integrate your GCP services with Splunk Observability Cloud. Before you proceed read Google's official announcement on GCP permission policies at :new-page:`Introducing stronger default Org Policies for our customers <https://cloud.google.com/blog/products/identity-security/introducing-stronger-default-org-policies-for-our-customers/>`.
+
+To authenticate using your service account keys go to the GCP console and follow these steps:
+
+#. From the sidebar, select :menuselection:`IAM & admin`, then :menuselection:`Service Accounts`.
+
+#. Go to :guilabel:`Create Service Account` at the top of the screen, complete the following fields, and select :guilabel:`CREATE`.
+
+   * **Service account name**. Enter ``Splunk``.
+
+   * **Service account ID**. This field autofills after you enter ``Splunk`` for Service account name.
+
+   * **Service account description**. Enter the description for your service account.
+
+#. Select a role to grant this Service account access to the selected project, then select :guilabel:`CONTINUE`.
+
+#. Activate Key type :guilabel:`JSON`, and select :guilabel:`CREATE`. A new service account key JSON file is then downloaded to your computer. You will need this key to authenticate in the :guilabel:`Import Service Account Key` step in Splunk Observability Cloud.
+
+#. In a new window or tab, go to :new-page:`Cloud Resource Manager API <https://console.cloud.google.com/apis/library/cloudresourcemanager.googleapis.com?pli=1>`, and activate the Cloud Resource Manager API. You need to activate this API so Splunk Observability Cloud can use it to validate permissions on the service account keys.
 
-See how to authenticate with WIF in the Splunk Observability Cloud developer documentation at :new-page:`Integrate GCP <https://dev.splunk.com/observability/docs/integrations/gcp_integration_overview>`.
+For more information, refer to GCP's docs on :new-page:`Service account keys <https://cloud.google.com/iam/docs/service-account-creds#key-types>`. 
 
 .. _gcp-prereqs-role-permissions: