Export Data to Google BigQuery

With WIF, Mondoo acts as an OIDC identity provider. When it's time to export, Mondoo issues a short-lived OIDC token and presents it to GCP. GCP validates the token against Mondoo's public signing keys (fetched from Mondoo's OIDC discovery endpoint), then issues temporary GCP credentials that Mondoo uses to write data to BigQuery. No static keys are stored or transmitted.

Step 1: Create a GCP service account

Create a GCP service account that Mondoo will impersonate to write data to BigQuery. Do not create a key for this service account—WIF replaces the need for static keys.

1. In the GCP Console, navigate to IAM & Admin > Service Accounts.

2. Select Create Service Account.

3. Give the service account a name (for example, mondoo-bq-export) and select Create and Continue.

4. Grant the service account the following roles:

   • BigQuery Data Editor (roles/bigquery.dataEditor)
   • BigQuery Job User (roles/bigquery.jobUser)

   For dataset-level permissions instead of project-level, grant BigQuery Data Editor on the specific dataset. To learn how, read Grant access to a dataset in the Google documentation.

5. Select Done. Note the service account email address (for example, mondoo-bq-export@PROJECT_ID.iam.gserviceaccount.com).

Step 2: Create a Workload Identity Pool

A Workload Identity Pool is a GCP resource that manages external identities. You create one pool and add Mondoo as an OIDC provider within it.

1. In the GCP Console, navigate to IAM & Admin > Workload Identity Federation.

2. Select Create Pool.

3. Enter a name for the pool (for example, mondoo-export-pool) and an optional description.

4. Make sure the pool is Enabled and select Continue.

Step 3: Add Mondoo as an OIDC provider to the pool

Within the Workload Identity Pool, add Mondoo as a trusted OpenID Connect (OIDC) identity provider. GCP uses Mondoo's OIDC discovery endpoint to fetch the public keys it needs to validate the tokens Mondoo presents during export.

1. In the pool you just created, select Add Provider.

2. For Select a provider, choose OpenID Connect (OIDC).

3. Enter a provider name (for example, mondoo-provider).

4. Set the Issuer (URL) to the Mondoo API endpoint for your environment:

   Environment	Issuer URL
   Mondoo (US)	https://api.mondoo.com
   Mondoo (EU)	https://eu.api.mondoo.com
   Mondoo Edge	https://api.edge.mondoo.com
   Dedicated deployment	https://api.mondoo.CUSTOMER.com

   GCP automatically fetches the OIDC discovery document from <issuer>/.well-known/openid-configuration to obtain Mondoo's signing keys. To learn more about Mondoo's OIDC endpoints, see Mondoo as an OIDC identity provider.

5. Under Audiences, select Allowed audiences and leave the default value. The audience is the full provider resource name, which you note in the next step.

6. Under Attribute Mapping, add this mapping:

   Google attribute	OIDC attribute
   google.subject	assertion.sub

7. Select Save.

Step 4: Note the WIF audience URL

After creating the provider, note the full audience URL. It follows this format:

https://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID

You can find this on the provider details page in the GCP Console. You enter this value in Mondoo in the next step.

:::tip

PROJECT_NUMBER is a numeric value, not the project ID string. Find it on your GCP project's dashboard or by running:

gcloud projects describe PROJECT_ID --format='value(projectNumber)'

:::

Step 5: Create the BigQuery export integration in Mondoo

1. In the Mondoo Console, navigate to the space from which you want to export data.

2. In the side navigation bar, select Integrations. Under Exports, select BigQuery.

3. Enter a name for the integration.

4. In the Enter the Dataset ID box, enter your BigQuery dataset ID (in the format PROJECT_ID.DATASET_ID). To find this value, read Listing datasets in the Google documentation.

5. Under Configure authentication, select Workload Identity Federation.

6. In the WIF Audience URL box, enter the audience URL from Step 4.

7. In the Service Account Email box, enter the email of the service account you created in Step 1 (for example, mondoo-bq-export@PROJECT_ID.iam.gserviceaccount.com).

8. Select CREATE INTEGRATION.

mutation {
  createIntegration(
    input: {
      spaceMrn: "//captain.api.mondoo.app/spaces/YOUR_SPACE_ID"
      name: "BigQuery WIF Export"
      type: BIGQUERY
      configurationOptions: {
        bigqueryOptions: {
          datasetId: "PROJECT_ID.DATASET_ID"
          serviceAccount: ""
          wifAudience: "https://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID"
          wifServiceAccountEmail: "mondoo-bq-export@PROJECT_ID.iam.gserviceaccount.com"
        }
      }
    }
  ) {
    integration {
      mrn
      configurationOptions {
        ... on BigqueryConfigurationOptions {
          datasetId
          wifSubject
          wifAudience
        }
      }
    }
  }
}

Step 6: Copy the WIF subject value

After you create the integration, Mondoo computes a WIF subject value that uniquely identifies this integration. You need this value to authorize Mondoo in GCP.

1. On the integration details page in the Mondoo Console, find the WifSubject field.

2. Copy the subject value. It has the format INTEGRATION_ID@integrations.SPACE_ID.

If you created the integration using the API, the subject is in the wifSubject field of the response.

:::note

The WIF subject is a computed, read-only value. Mondoo generates it automatically when you create the integration—you cannot set or change it.

:::

Step 7: Authorize the WIF subject to impersonate the service account

Back in GCP, you must grant the WIF subject the Workload Identity User role on the service account you created in Step 1. This allows Mondoo's OIDC-validated identity to impersonate the service account and write to BigQuery.

Run this gcloud command, substituting your own values:

gcloud iam service-accounts add-iam-policy-binding \
  mondoo-bq-export@PROJECT_ID.iam.gserviceaccount.com \
  --project=PROJECT_ID \
  --role="roles/iam.workloadIdentityUser" \
  --member="principal://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/subject/SUBJECT_VALUE"

Step 8: Verify the integration

The export runs on its configured schedule (approximately every 24 hours). To verify the setup works immediately:

1. Return to the integration details page in the Mondoo Console.

2. Select the SCHEDULE NOW button to trigger an immediate export.

3. Wait for the export to complete. If the status changes to active, the setup is working correctly.

If the export fails, double-check:

• The WIF audience URL matches the full provider resource name in GCP exactly (including project number, pool ID, and provider ID).
• The service account email is correct.
• The gcloud iam service-accounts add-iam-policy-binding command completed successfully with the correct subject value.
• The service account has the required BigQuery roles (BigQuery Data Editor and BigQuery Job User).

Step 1: Create a GCP service account and JSON key

To access BigQuery, your integration needs a GCP service account with a JSON key. To learn about service accounts, read Understanding service accounts in the Google documentation.

1. Create a new GCP service account for the Mondoo integration to use.

   For instructions, read Creating and managing service accounts in the Google documentation.

   Note the email address created for the new service account.

2. Grant the service account the following roles:

   • BigQuery Data Editor (roles/bigquery.dataEditor)
   • BigQuery Job User (roles/bigquery.jobUser)

   To learn how, read Grant access to a dataset in the Google documentation.

3. Create a JSON key for the service account.

   For instructions, read Create and manage service account keys in the Google documentation.

   Save the JSON file that downloads to your workstation when you create the key. You need it to configure the integration in the next step.

Step 2: Add the integration in Mondoo

1. In the Mondoo Console, navigate to the space from which you want to export data. In the side navigation bar, select Integrations. Under Exports, select BigQuery.

2. Enter a name for the integration.

3. In the Enter the Dataset ID box, enter your BigQuery dataset ID (in the format PROJECT_ID.DATASET_ID). To find this value, read Listing datasets in the Google documentation.

4. Under Configure authentication, select Service Account Key.

5. Drag and drop the JSON key file you downloaded earlier, or select the cloud icon to browse for it.

6. Select CREATE INTEGRATION.

   Mondoo begins exporting data from your space. When the initial export completes, the status becomes active. Exports then run automatically approximately every 24 hours.