Export Data to a Google Cloud Storage Bucket

Set up continuous export of assets, vulnerabilities, and scan results from Mondoo to a Google Cloud Storage bucket using one-click Workload Identity Federation, manual WIF, or a service account key.

Export your Mondoo security data to a Google Cloud Storage bucket for long-term retention, custom reporting, or integration with a GCP data pipeline. For how exports work in general, read Continuous Data Exports.

Requirements

A GCP project
Editor or Owner access to the Mondoo space from which you want to export data
Permission in GCP to create service accounts, Workload Identity Pools, and IAM policy bindings

Create a Cloud Storage bucket

Your Cloud Storage integration needs a bucket to which to export data. To learn about buckets, read About Cloud Storage buckets in the Google documentation.

Create a new GCP Cloud Storage bucket for the Mondoo integration to use. For instructions, read Create buckets in the Google documentation.

Note the bucket name. You need it when you configure the integration.

Choose an authentication method

Mondoo can authenticate to GCP in three ways:

One-click Workload Identity Federation (WIF) (recommended): Keyless. You give Mondoo your project ID and project number, and Mondoo hands you a ready-to-run gcloud script that creates everything WIF needs in your project. Nothing to rotate, and no values to copy back into Mondoo.
Manual WIF: Also keyless, but you create the Workload Identity Pool, OIDC provider, and service account yourself, then paste the audience URL and service account email into Mondoo. Use this path when your organization requires specific resource names, or when a pool already exists.
Service account key: A static JSON key file. Simplest to set up, but you're responsible for securely storing and regularly rotating the key.

With WIF, Mondoo acts as an OIDC identity provider. When it's time to export, Mondoo issues a short-lived OIDC token and presents it to GCP. GCP validates the token against Mondoo's public signing keys (fetched from Mondoo's OIDC discovery endpoint), then issues temporary GCP credentials that Mondoo uses to write data to Cloud Storage. No static keys are stored or transmitted.

In the one-click flow, Mondoo generates the setup script for you. The script creates these resources in your project:

Resource	Name
Workload Identity Pool	`mondoo-pool`
OIDC provider	`mondoo-provider`
Export service account	`mondoo-export@PROJECT_ID.iam.gserviceaccount.com`

It also grants the export service account the Storage Object Admin role (roles/storage.objectAdmin) on the target bucket only, and authorizes the pool to impersonate that service account.

The script is safe to run more than once. Every resource it creates is idempotent, so if a step fails you can run the whole script again.

Step 1: Find your project ID and project number

Both values appear on your Google Cloud console dashboard. Neither is the project's display name.

The project ID is the unique ID string, for example my-project-123.
The project number is the auto-assigned numeric ID, for example 123456789012.

To retrieve them from the CLI:

gcloud projects describe PROJECT_ID --format='value(projectId,projectNumber)'

Step 2: Create the Cloud Storage export integration in Mondoo

In the Mondoo App, navigate to the space from which you want to export data.
In the side navigation bar, select Integrations. Under Exports, select GCP Cloud Storage Bucket.
In the Choose an integration name box, enter a name for the integration.
In the Bucket name box, enter the name of the bucket you created earlier.
Under Export as, select JSONL or CSV.
Select the Workload Identity Federation (recommended) tab.
In the Project ID box, enter your project ID. In the Project number box, enter your project number.
Select Generate setup.

Mondoo creates the integration and shows you the setup script. No data is exported yet.

Step 3: Run the setup script in Google Cloud

Select Open in Google Cloud Shell. Cloud Shell opens in a new tab, scoped to the project you entered.
Copy the script from Mondoo, paste it into Cloud Shell, and press Enter.
Wait for the script to print Mondoo GCP export setup complete. If you don't see that line, the script didn't finish. Run it again.

You can also run the script from any workstation with the GCP CLI (gcloud) installed and authenticated to the target project.

Step 4: Run the first export

Return to the Mondoo tab and select Run first export.

New GCP permissions can take a few minutes to propagate. If the first export fails with a permissions error, wait a moment and try again.

Step 5: Verify the integration

On the integration details page, wait for the export to complete. If the status changes to active, the setup is working correctly.
Exports then run automatically approximately every 24 hours.

If the export fails, double-check:

The setup script finished successfully in the same project whose ID and number you entered in Mondoo.
The bucket name is correct and the bucket exists.
The mondoo-export service account has the Storage Object Admin role on the bucket.

Manage this integration

After it's created, find your integration under Integrations in your space's side navigation. Select it to open the detail page, where you can:

Trigger a manual export. Exports run automatically about every 24 hours. To export immediately, select SCHEDULE NOW.
Check the status. active means the integration is healthy and exporting on schedule. pending means Mondoo hasn't attempted the first export yet. error means the last export failed.
Remove the integration. Select the trash can icon and confirm. Mondoo stops future exports but does not delete data that has already been exported.