# Create a GCP service account with read-only access

> Step by step guide to create a GCP service account with read-only access for monitoring

Source: https://last9.io/docs/create-gcp-service-account-with-read-only-access/

## Objective

A service account is required to access GCP environment resources for monitoring.
This doc provides step by step information on creating a GCP service account
with monitoring read-only access.

Once you have created the account, share the configuration with Last9 team so
that the monitoring data can be sent to [Last9](https://last9.io/).

## Prerequisites

- Go to the Google Cloud Console ([console.cloud.google.com](https://console.cloud.google.com/)) account
- Select the project in which you want to create the service account
- Click on the "IAM & Admin" tab in the left navigation menu
- Click on the "Service Accounts" tab
  ![Create Service Account](../../../../assets/content/docs/tutorials/create-gcp-service-account-with-read-only-access/gcp-account-create-service-account-1.png)

:::note
For a GCP Project, ensure that you have access to create credentials and grant permissions.
:::

## Creating Service Account

- Click on the "Create Service Account" button
- Enter following details
  1. Service Account Name: `last9-monitor`
  2. Service Account ID: `last9-monitor`
  3. Service Account Description: _Allows Last9 API access to read resource metadata and monitoring data_
- Click on the "Create and Continue" button
  ![Create Service Account Form](../../../../assets/content/docs/tutorials/create-gcp-service-account-with-read-only-access/gcp-service-account-create-form.png)

## Monitoring Viewer Role

Grant Permissions to this Service Account with Role as `Monitoring Viewer`.

![Monitoring Viewer Role](../../../../assets/content/docs/tutorials/create-gcp-service-account-with-read-only-access/gcp-service-account-monitoring-viewer-role.png)

Grant other users internal to your organization access to this Service Account(Optional)
![Add other users optionally](../../../../assets/content/docs/tutorials/create-gcp-service-account-with-read-only-access/gcp-service-account-other-users.png)

## Generate Credentials

- Click on the newly created Service Account to view more details
  ![Click on the Servive Account](../../../../assets/content/docs/tutorials/create-gcp-service-account-with-read-only-access/gcp-service-account-list.png)

- Create a new Service Account Key
  ![Create a new Service Account Key](../../../../assets/content/docs/tutorials/create-gcp-service-account-with-read-only-access/gcp-service-account-create-access-key.png)
  ![Download the Service Account Key](../../../../assets/content/docs/tutorials/create-gcp-service-account-with-read-only-access/gcp-service-account-create-access-key.png)
- Share the downloaded key with your Last9 team