GSuite (legacy, service account)
Purpose
Ingests Google Workspace users and groups using a service account with domain-wide delegation. Prefer the OAuth-based googleworkspace module when possible.
tip
Secret fields below accept either an AWS Secrets Manager ARN or a value pasted directly into SubImage's managed vault. See Secrets for details.
Required Fields
| Field | Secret? | Description |
|---|---|---|
gsuite_service_account_key |
Yes | Service account JSON key |
gsuite_admin_email |
No | Email address of a Super Admin to impersonate |
Required Admin SDK scopes
https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.group.memberSetup Steps
- Enable the Admin SDK API in Google Cloud.
- Create service account
subimage-google-workspace; grant it Service Account User. - Generate a JSON key and download it.
- Under Advanced Settings, enable Domain-Wide Delegation and copy the Client ID.
- In Google Admin Console → Security → API Controls → Domain-wide delegation, add the Client ID and the scopes above.
- In SubImage, fill in:
gsuite_service_account_key— the JSON key content (or its AWS Secret ARN)gsuite_admin_email— the Super Admin to impersonate
- Save the module.