Run ReportsContinuous Data Exports

Export Data to a Google Cloud Storage Bucket

Set up continuous export of assets, vulnerabilities, and scan results from Mondoo to a Google Cloud Storage bucket using Workload Identity Federation or a service account key.

Export your Mondoo security data to a Google Cloud Storage bucket for long-term retention, custom reporting, or integration with a GCP data pipeline. For how exports work in general, read Continuous Data Exports.

Requirements

  • A GCP project

  • Editor or Owner access to the Mondoo space from which you want to export data

  • Permission in GCP to create service accounts, Workload Identity Pools, and IAM policy bindings

Create a Cloud Storage bucket

Your Cloud Storage integration needs a bucket to which to export data. To learn about buckets, read About Cloud Storage buckets in the Google documentation.

Create a new GCP Cloud Storage bucket for the Mondoo integration to use. For instructions, read Create buckets in the Google documentation.

Note the bucket name. You need it when you configure the integration.

Choose an authentication method

Mondoo can authenticate to GCP in two ways:

  • Workload Identity Federation (WIF) (recommended): Keyless. You create a Workload Identity Pool, an OIDC provider for Mondoo, and a service account in GCP, then paste the audience URL and service account email into Mondoo. Nothing to rotate.

  • Service account key: A static JSON key file. Simplest to set up, but you're responsible for securely storing and regularly rotating the key.

With WIF, Mondoo acts as an OIDC identity provider. When it's time to export, Mondoo issues a short-lived OIDC token and presents it to GCP. GCP validates the token against Mondoo's public signing keys (fetched from Mondoo's OIDC discovery endpoint), then issues temporary GCP credentials that Mondoo uses to write data to Cloud Storage. No static keys are stored or transmitted.

Step 1: Create a GCP service account

Create a GCP service account that Mondoo will impersonate to write data to your Cloud Storage bucket. Do not create a key for this service account; WIF replaces the need for static keys.

  1. In the GCP Console, navigate to IAM & Admin > Service Accounts.

  2. Select Create Service Account.

  3. Give the service account a name (for example, mondoo-gcs-export) and select Create and Continue.

  4. Grant the service account the Storage Object Creator role (roles/storage.objectCreator) for the bucket.

    For instructions, read Manage access to projects, folders, and organizations in the Google documentation.

  5. Select Done. Note the service account email address (for example, mondoo-gcs-export@PROJECT_ID.iam.gserviceaccount.com).

Step 2: Create a Workload Identity Pool

A Workload Identity Pool is a GCP resource that manages external identities. You create one pool and add Mondoo as an OIDC provider within it.

If you already created a Workload Identity Pool and Mondoo OIDC provider for another export (such as BigQuery), you can reuse it. Skip to Step 4.

  1. In the GCP Console, navigate to IAM & Admin > Workload Identity Federation.

  2. Select Create Pool.

  3. Enter a name for the pool (for example, mondoo-export-pool) and an optional description.

  4. Make sure the pool is Enabled and select Continue.

Step 3: Add Mondoo as an OIDC provider to the pool

Within the Workload Identity Pool, add Mondoo as a trusted OpenID Connect (OIDC) identity provider.

  1. In the pool you just created, select Add Provider.

  2. For Select a provider, choose OpenID Connect (OIDC).

  3. Enter a provider name (for example, mondoo-provider).

  4. Set the Issuer (URL) to the Mondoo STS endpoint for your environment:

    EnvironmentIssuer URL
    Mondoo (US)https://sts.us.mondoo.com
    Mondoo (EU)https://sts.eu.mondoo.com
    Mondoo Edgehttps://sts.edge.mondoo.com
    Dedicated deploymenthttps://sts.mondoo.CUSTOMER.com

    GCP automatically fetches the OIDC discovery document from <issuer>/.well-known/openid-configuration to obtain Mondoo's signing keys. To learn more about Mondoo's OIDC endpoints, see Mondoo as an OIDC identity provider.

  5. Under Audiences, select Allowed audiences and leave the default value. The audience is the full provider resource name, which you note in the next step.

  6. Under Attribute Mapping, add this mapping:

    Google attributeOIDC attribute
    google.subjectassertion.sub

  7. Select Save.

Step 4: Note the WIF audience URL

After creating the provider, note the full audience URL. It follows this format:

https://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID

You can find this on the provider details page in the GCP Console. You enter this value in Mondoo in the next step.

PROJECT_NUMBER is a numeric value, not the project ID string. Find it on your GCP project's dashboard or by running:

gcloud projects describe PROJECT_ID --format='value(projectNumber)'

Step 5: Create the Cloud Storage export integration in Mondoo

  1. In the Mondoo App, navigate to the space from which you want to export data.

  2. In the side navigation bar, select Integrations, then select INSTALL. Under Data Exports, select GCP Cloud Storage Bucket.

    The GCP Cloud Storage Bucket integration form in Mondoo, with the Integration name, Bucket name, and Export as fields

  3. In the Integration name box, enter a name for the integration.

  4. In the Bucket name box, enter the name of the bucket you created earlier.

  5. Under Export as, select JSONL or CSV.

  6. Select the Workload Identity Federation (recommended) tab.

  7. In the WIF Audience URL box, enter the audience URL from Step 4.

  8. In the Service Account Email (for impersonation) box, enter the email of the service account you created in Step 1 (for example, mondoo-gcs-export@PROJECT_ID.iam.gserviceaccount.com).

  9. Select Create Integration.

Creating the integration immediately attempts a first export, but the GCP binding that authorizes Mondoo doesn't exist yet, so that attempt fails. That's expected. Complete Steps 6 and 7, then run a fresh export in Step 8.

Step 6: Copy the WIF subject value

After you create the integration, Mondoo computes a WIF subject value that uniquely identifies this integration. You need this value to authorize Mondoo in GCP.

  1. On the integration details page in the Mondoo App, find the WifSubject field.

  2. Copy the subject value. It has the format INTEGRATION_ID@integrations.SPACE_ID.spaces.iam.REGION.mondoo.app, where REGION is the short name of your Mondoo region (for example, us).

The WIF subject is a computed, read-only value. Mondoo generates it automatically when you create the integration; you cannot set or change it.

Step 7: Authorize the WIF subject to impersonate the service account

Back in GCP, grant the WIF subject the Workload Identity User role on the service account you created in Step 1. This allows Mondoo's OIDC-validated identity to impersonate the service account and write to Cloud Storage.

Run this gcloud command, substituting your own values:

gcloud iam service-accounts add-iam-policy-binding \
  mondoo-gcs-export@PROJECT_ID.iam.gserviceaccount.com \
  --project=PROJECT_ID \
  --role="roles/iam.workloadIdentityUser" \
  --member="principal://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/subject/SUBJECT_VALUE"
PlaceholderReplace with
PROJECT_IDYour GCP project ID (the string identifier, not the number)
PROJECT_NUMBERYour GCP project number (numeric)
POOL_IDThe Workload Identity Pool ID from Step 2
SUBJECT_VALUEThe WIF subject value you copied in Step 6

Step 8: Verify the integration

The export runs on its configured schedule (approximately every 24 hours). To verify the setup works immediately:

  1. Return to the integration details page in the Mondoo App.

  2. Select RUN to trigger an immediate export.

  3. Wait for the export to complete. If the status changes to active, the setup is working correctly.

If the export fails, double-check:

  • The WIF audience URL matches the full provider resource name in GCP exactly (including project number, pool ID, and provider ID).
  • The service account email is correct.
  • The gcloud iam service-accounts add-iam-policy-binding command completed successfully with the correct subject value.
  • The service account has the required Storage Object Creator role.

Manage this integration

After it's created, find your integration under Integrations in your space's side navigation. Select it to open the detail page, where you can:

  • Trigger a manual export. Exports run automatically about every 24 hours. To export immediately, select RUN.
  • Check the status. ACTIVE means the integration is healthy and exporting on schedule. PENDING means Mondoo hasn't attempted the first export yet. ERROR means the last export failed. The Export Details section shows when the last export succeeded and when Mondoo last attempted one.
  • Review the activity log. Most Recent Activity lists each export run's messages, such as when a job started, finished, or failed and why. Filter it to errors, warnings, or info messages.
  • Change the settings. Select the pencil icon to edit the integration, for example to update credentials.
  • Remove the integration. Select the trash can icon and confirm. Mondoo stops future exports but does not delete data that has already been exported.

Next steps

Azure Blob Storage

Set up continuous export of assets, vulnerabilities, and scan results from Mondoo to Azure Blob Storage containers.

S3-Compatible Service

Set up continuous export of assets, vulnerabilities, and scan results from Mondoo to MinIO, Ceph, or any other S3-compatible storage service.

On this page

RequirementsCreate a Cloud Storage bucketChoose an authentication methodStep 1: Create a GCP service accountStep 2: Create a Workload Identity PoolStep 3: Add Mondoo as an OIDC provider to the poolStep 4: Note the WIF audience URLStep 5: Create the Cloud Storage export integration in MondooStep 6: Copy the WIF subject valueStep 7: Authorize the WIF subject to impersonate the service accountStep 8: Verify the integrationStep 1: Create a GCP service account and JSON keyStep 2: Add the integration in MondooNext steps