Configure your Google Cloud project for Mainframe Assessment Tool

This page describes the process to set up and configure your Google Cloud project to work with Mainframe Assessment Tool.

Before you begin

1. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

   Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

   Go to project selector

2. Make sure that billing is enabled for your Google Cloud project. For more information, see Verify the billing status of your projects.

3. Create a dedicated service account to access Mainframe Assessment Tool. For more information, see Create service accounts.

4. For large assessments, make sure that you have sufficient quota in the region where you plan to create the Mainframe Assessment Tool instance. Larger quotas can be allocated by purchasing a Provisioned Throughput

Enable APIs

1. Enable the Compute Engine API.

   Enable Compute Engine API

2. Enable the Vertex AI API.

   Enable Vertex AI API

Configure firewall rules

To enable secure access to the Mainframe Assessment Tool instance through IAP, create the following firewall rules:

1. Create a firewall rule to allow ingress traffic on TCP port 4000 by using IAP for TCP forwarding:

   gcloud compute firewall-rules create allow-ingress-from-iap \
     --direction=INGRESS \
     --action=allow \
     --rules=tcp:4000\
     --source-ranges=35.235.240.0/20
   

2. Create a firewall rule to deny all other ingress traffic to your Mainframe Assessment Tool instance:

    gcloud compute firewall-rules create deny-all-other-ingress \
     --direction=ingress \
     --action=deny \
     --rules=all \
     --source-ranges=0.0.0.0/0 \
     --network=your-network-name \
     --priority=65535
   

Assign IAM roles and permissions

To ensure that the dedicated service account that you created has the necessary permissions to give the Mainframe Assessment Tool components the required access to the Vertex AI API and other services, ask your administrator to grant the dedicated service account that you created the following IAM roles:

Important: You must grant these roles to the dedicated service account that you created, not to your user account. Failure to grant the roles to the correct principal might result in permission errors.

• Vertex AI User (roles/aiplatform.user)
• Cloud Logging: Cloud Logging Writer (roles/logging.logWriter)

What's next

• Learn how to Set up and access Mainframe Assessment Tool.