Google Cloud
Give the Sazabi agent the Google Cloud CLI (gcloud) in its sandbox to manage Google Cloud resources with a service account.
About
This CLI connection makes the Google Cloud CLI (gcloud, gsutil, bq) available in the Sazabi agent's sandbox. The tools are baked into the sandbox image; connecting them authenticates the already-installed CLIs.
Prerequisites
- A Sazabi project.
- A Google Cloud service account key as a JSON string (
GCLOUD_SERVICE_ACCOUNT_KEY_JSON), downloaded from IAM & Admin > Service Accounts in the Google Cloud console. - A Google Cloud project ID (
GCLOUD_PROJECT_ID) — the project the service account belongs to.
Set up in the dashboard
Configure the sandbox in the dashboard under Settings > Sandbox CLIs.
Find Google Cloud in the catalog
In Settings > Sandbox CLIs, find Google Cloud under Browse sandbox CLIs and choose to connect it.
Provide credentials
Enter the required values: GCLOUD_SERVICE_ACCOUNT_KEY_JSON — the full contents of your service account key JSON file; GCLOUD_PROJECT_ID — your Google Cloud project ID. Optionally, set GCLOUD_COMPUTE_REGION (e.g. us-central1) and GCLOUD_COMPUTE_ZONE (e.g. us-central1-a) to pre-configure compute defaults. Save to store them securely; Sazabi injects them into the sandbox when the agent runs.
Set up with the CLI
You can also configure the Google Cloud CLI connection with the Sazabi CLI (installed and authenticated — see CLI reference).
sazabi sandbox-clis set --type gcloud --env GCLOUD_SERVICE_ACCOUNT_KEY_JSON="$(cat service-account.json)" --env GCLOUD_PROJECT_ID=<your-project-id>To validate the credentials without saving, run the same command with test in place of set (the test command also requires the --env flags).
Verify
Ask the agent, in a thread, to run the gcloud CLI (a read-only or status command) and confirm it returns real output from your account. If the command is not found, the CLI connection may not be enabled; if it runs unauthenticated, recheck the credentials.
Troubleshooting
Command not found — Confirm the Google Cloud CLI connection is enabled for the project under Settings > Sandbox CLIs.
Authentication fails — Recheck the credential values; a rotated or revoked token must be re-entered under Settings > Sandbox CLIs or with sazabi sandbox-clis set --type gcloud.