# Connect Google Cloud Profiler.

Connect profiles from one Google Cloud project. Perfloop uses a dedicated service account to read profiles and stores the ones it uses for performance work.

Updated 18 September 2026.

## Access you need

A project IAM administrator runs the commands from Setup to create a dedicated service account for your Perfloop account and Google Cloud project. Its custom role contains only cloudprofiler.profiles.list. It grants no access to other Google resource types, such as buckets, databases, secrets, or VMs.

- cloudprofiler.profiles.list Lists Cloud Profiler profiles for the selected project. No write permission.
- Workload Identity impersonation Perfloop uses Workload Identity to act as the dedicated reader with short-lived credentials. You do not need to upload a service-account key or authorize your personal Google account.

Perfloop uses the credential to read profiles. Models and execution sandboxes do not receive it.

## Setup

### 1 · select the project

In Perfloop Setup, choose **Google Cloud Profiler** and enter the project that holds your profiles.

### 2 · install the dedicated reader

Run the Cloud Shell commands from Setup in your selected project. They create the service account, assign its read permission, and allow Perfloop to use it through Workload Identity.

Check the project, service account, and permissions in the generated commands before you run them.

### 3 · validate the read

Return to Setup and validate the connection. Perfloop uses the service account to request the project's profiles. It saves the connection after this check passes.

## Data Perfloop reads

Google returns profiles for the whole project. Perfloop then selects the workload, profile type, and time window needed for the query. To restrict which profiles Perfloop can receive from Google, use a separate project. A workload or time filter in Perfloop does not reduce the service account's project access.

Perfloop stores selected profiles in pprof format. Its models can use profile tools to read stack samples, function and file names, build IDs, and labels. Review these fields before connecting a project if they contain sensitive names or identifiers.

## Change or remove access

To change the project or service account, run a new install from Setup and validate it. The existing connection stays active until the new one passes validation. To stop reads, remove the Workload Identity binding or the service account's custom role in Google Cloud. This does not delete profiles already stored in Perfloop.

## Provider documentation

- [Google Cloud Profiler IAM roles and permissions](https://docs.cloud.google.com/profiler/docs/iam)

Security questions: [security@perfloop.ai](mailto:security@perfloop.ai?subject=Google%20Cloud%20Profiler%20connection%20review)