Export Data to a Google Cloud Storage Bucket

With WIF, Mondoo acts as an OIDC identity provider. When it's time to export, Mondoo issues a short-lived OIDC token and presents it to GCP. GCP validates the token against Mondoo's public signing keys (fetched from Mondoo's OIDC discovery endpoint), then issues temporary GCP credentials that Mondoo uses to write data to Cloud Storage. No static keys are stored or transmitted.

Step 1: Create a GCP service account

Create a GCP service account that Mondoo will impersonate to write data to your Cloud Storage bucket. Do not create a key for this service account—WIF replaces the need for static keys.

1. In the GCP Console, navigate to IAM & Admin > Service Accounts.

2. Select Create Service Account.

3. Give the service account a name (for example, mondoo-gcs-export) and select Create and Continue.

4. Grant the service account the Storage Object Creator role (roles/storage.objectCreator) for the bucket.

   For instructions, read Manage access to projects, folders, and organizations in the Google documentation.

5. Select Done. Note the service account email address (for example, mondoo-gcs-export@PROJECT_ID.iam.gserviceaccount.com).

Step 2: Create a Workload Identity Pool

A Workload Identity Pool is a GCP resource that manages external identities. You create one pool and add Mondoo as an OIDC provider within it.

:::tip

If you already created a Workload Identity Pool and Mondoo OIDC provider for another export (such as BigQuery), you can reuse it. Skip to Step 4.

:::

1. In the GCP Console, navigate to IAM & Admin > Workload Identity Federation.

2. Select Create Pool.

3. Enter a name for the pool (for example, mondoo-export-pool) and an optional description.

4. Make sure the pool is Enabled and select Continue.

Step 3: Add Mondoo as an OIDC provider to the pool

Within the Workload Identity Pool, add Mondoo as a trusted OpenID Connect (OIDC) identity provider.

1. In the pool you just created, select Add Provider.

2. For Select a provider, choose OpenID Connect (OIDC).

3. Enter a provider name (for example, mondoo-provider).

4. Set the Issuer (URL) to the Mondoo API endpoint for your environment:

   Environment	Issuer URL
   Mondoo (US)	https://api.mondoo.com
   Mondoo (EU)	https://eu.api.mondoo.com
   Mondoo Edge	https://api.edge.mondoo.com
   Dedicated deployment	https://api.mondoo.CUSTOMER.com

   GCP automatically fetches the OIDC discovery document from <issuer>/.well-known/openid-configuration to obtain Mondoo's signing keys. To learn more about Mondoo's OIDC endpoints, see Mondoo as an OIDC identity provider.

5. Under Audiences, select Allowed audiences and leave the default value. The audience is the full provider resource name, which you note in the next step.

6. Under Attribute Mapping, add this mapping:

   Google attribute	OIDC attribute
   google.subject	assertion.sub

7. Select Save.

Step 4: Note the WIF audience URL

After creating the provider, note the full audience URL. It follows this format:

https://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID

You can find this on the provider details page in the GCP Console. You enter this value in Mondoo in the next step.

:::tip

PROJECT_NUMBER is a numeric value, not the project ID string. Find it on your GCP project's dashboard or by running:

gcloud projects describe PROJECT_ID --format='value(projectNumber)'

:::

Step 5: Create the Cloud Storage export integration in Mondoo

1. In the Mondoo Console, navigate to the space from which you want to export data.

2. In the side navigation bar, select Integrations. Under Exports, select GCP Cloud Storage Bucket.

   

3. Enter a name for the integration.

4. In the Bucket name box, enter the name of the bucket you created earlier.

5. Under Export as, select .jsonl or .csv.

6. Under Configure authentication, select Workload Identity Federation.

7. In the WIF Audience URL box, enter the audience URL from Step 4.

8. In the Service Account Email box, enter the email of the service account you created in Step 1 (for example, mondoo-gcs-export@PROJECT_ID.iam.gserviceaccount.com).

9. Select CREATE EXPORT.

Step 6: Copy the WIF subject value

After you create the integration, Mondoo computes a WIF subject value that uniquely identifies this integration. You need this value to authorize Mondoo in GCP.

1. On the integration details page in the Mondoo Console, find the WifSubject field.

2. Copy the subject value. It has the format INTEGRATION_ID@integrations.SPACE_ID.

:::note

The WIF subject is a computed, read-only value. Mondoo generates it automatically when you create the integration—you cannot set or change it.

:::

Step 7: Authorize the WIF subject to impersonate the service account

Back in GCP, grant the WIF subject the Workload Identity User role on the service account you created in Step 1. This allows Mondoo's OIDC-validated identity to impersonate the service account and write to Cloud Storage.

Run this gcloud command, substituting your own values:

gcloud iam service-accounts add-iam-policy-binding \
  mondoo-gcs-export@PROJECT_ID.iam.gserviceaccount.com \
  --project=PROJECT_ID \
  --role="roles/iam.workloadIdentityUser" \
  --member="principal://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/subject/SUBJECT_VALUE"

Step 8: Verify the integration

The export runs on its configured schedule (approximately every 24 hours). To verify the setup works immediately:

1. Return to the integration details page in the Mondoo Console.

2. Select the SCHEDULE NOW button to trigger an immediate export.

3. Wait for the export to complete. If the status changes to active, the setup is working correctly.

If the export fails, double-check:

• The WIF audience URL matches the full provider resource name in GCP exactly (including project number, pool ID, and provider ID).
• The service account email is correct.
• The gcloud iam service-accounts add-iam-policy-binding command completed successfully with the correct subject value.
• The service account has the required Storage Object Creator role.

Step 1: Create a GCP service account and JSON key

To access Cloud Storage, your integration needs a GCP service account with a JSON key. To learn about service accounts, read Understanding service accounts in the Google documentation.

1. Create a new GCP service account for the Mondoo integration to use.

   For instructions, read Creating and managing service accounts in the Google documentation.

   Note the email address created for the new service account.

2. Grant the service account the Storage Object Creator role (roles/storage.objectCreator) for the bucket.

   For instructions, read Manage access to projects, folders, and organizations in the Google documentation.

3. Create a JSON key for the service account.

   For instructions, read Create and manage service account keys in the Google documentation.

   Save the JSON file that downloads to your workstation when you create the key. You need it to configure the integration in the next step.

Step 2: Add the integration in Mondoo

1. In the Mondoo Console, navigate to the space from which you want to export data. In the side navigation bar, select Integrations. Under Exports, select GCP Cloud Storage Bucket.

   

2. Enter a name for the integration.

3. In the Bucket name box, enter the name of the bucket you created in the previous section.

4. Under Export as, select .jsonl or .csv.

5. Under Configure authentication, select Service Account Key.

6. Drag and drop the JSON key file you downloaded earlier, or select the cloud icon to browse for it.

7. Select CREATE EXPORT.

   Mondoo begins exporting data from your space. When the initial export completes, the status becomes active. Exports then run automatically approximately every 24 hours.