Manage your GCP connections (Preview)

Latest Dynatrace
How-to guide
Published Feb 20, 2026
Preview

Connection visibility

A connection can see multiple Google Cloud projects. Use the Projects tab to view which projects are visible and monitored.

If the same project is visible to multiple connections, you risk ingesting duplicate data. Dynatrace detects and flags these situations. To resolve the issue, either change the service account permissions or use the connection filters.

Connection health

Preview limitation

The health features are not yet available.

The Overview tab shows ingestion status for topology, metrics, and logs.

The Health tab displays connection status. A new connection starts as Pending until we successfully authenticate with your Google Cloud service account. A connection is Unhealthy if we cannot authenticate or reach Google Cloud.

Edit a connection

To modify an existing connection

Go to the connections list in Settings > Collect and capture > Cloud and virtualization > Google Cloud (Preview).
Select the connection name, or select and choose Manage.
Modify the desired settings (metrics, filters, enrichment rules).
Select Save to apply changes.

Most changes take effect immediately. However, some changes require updates to your Google Cloud configuration:

Change	Google Cloud action required
Monitor additional projects	Grant service account `roles/viewer` on new projects
Monitor additional folders	Grant service account `roles/resourcemanager.folderViewer` on new folders
Enable log forwarding	Deploy log forwarding infrastructure (Terraform re-run or manual setup)
Enable or update asset inventory feeds	Deploy asset feed infrastructure or update them to reflect new asset types (Terraform re-run or manual setup)
Rotate Log Ingest token	Update the token in deployed Google Cloud infrastructure (Dataflow config)

Disable or enable a connection

You can temporarily disable a connection to stop data collection without deleting it.

To disable or enable a connection:

Go to the connections list in Settings > Collect and capture > Cloud and virtualization > Google Cloud (Preview).
Select on the right-hand side of the connection table.
Select Disable or Enable.

What happens when I disable a connection?

Dynatrace stops polling metrics and topology from Google Cloud
Log and asset inventory forwarding (if configured) continues until you disable the Google Cloud infrastructure
The connection configuration is preserved
Historical data already ingested remains in Dynatrace

When to use this?

Temporarily pause monitoring during maintenance windows
Troubleshoot issues without losing your configuration
Reduce costs when monitoring is not needed temporarily

To resume monitoring, enable the connection using the same menu.

Delete a connection

To delete a connection

Go to the connections list in Settings > Collect and capture > Cloud and virtualization > Google Cloud (Preview).
Select on the right-hand side of the connection table.
Select Delete and confirm.

What happens when I delete a connection?

Dynatrace stops polling metrics and topology from Google Cloud
Historical data already ingested remains in Dynatrace (subject to retention policies)
Google Cloud resources (service account, IAM bindings, forwarding infrastructure) are not automatically removed—you must clean these up manually or run terraform destroy.

Troubleshooting

Connection status: `Pending`

A connection shows Pending status when it has been created in Dynatrace but the Google Cloud deployment is not yet complete. This is expected immediately after running the connection wizard. The status changes to Healthy once Dynatrace successfully authenticates with your Google Cloud service account.

While a connection is Pending, the Manage and Enable/Disable actions in the menu are disabled. If a connection remains stuck in Pending, see Connection stuck in Pending status under Common issues.

Connection status: `Unhealthy`

If a connection shows Unhealthy status, check the following

Symptom	Possible cause	Solution
Authentication failed	Service account doesn't exist	Verify service account was created in Google Cloud
Authentication failed	Dynatrace service account lacks impersonation rights	Grant `roles/iam.serviceAccountTokenCreator` to Dynatrace service account
Authentication failed	Domain-restricted sharing blocks Dynatrace	Add Dynatrace customer identity to allowed domains
No metrics data	Required APIs not enabled	Enable `monitoring.googleapis.com` API
No topology data	Required APIs not enabled	Enable `cloudasset.googleapis.com` and `cloudresourcemanager.googleapis.com` APIs
Partial data	Service account lacks permissions	Grant `roles/viewer` on all projects to monitor

Common issues

Connection stuck in `Pending` status

If a connection remains in Pending status, verify the following steps have been completed:

Google Cloud deployment: Ensure the Terraform scripts have been deployed or the manual setup is complete. See Manual onboarding reference for step-by-step instructions.

Monitoring configuration linked and enabled: Link the service account to the connection and enable monitoring:

dtctl enable gcp monitoring \
    --name "<configuration-name>" \
    --serviceAccountId "<service-account-email>"

IAM configuration: Verify that the service account exists, the required APIs are enabled, and the Dynatrace platform has impersonation rights. See the prerequisites for details.

"Permission denied" errors in the Health tab

The service account doesn't have sufficient permissions on the target projects/folders
Solution: Re-run Terraform or manually grant roles/viewer. If your organization requires more granular permissions, see the Grant permissions to the service account section in Manual onboarding reference for the exact IAM permissions list.

Connection is healthy but no data appears

Filters may be excluding all projects
Solution: Check folder/project filters in connection settings

Missing metrics for specific services

The service may be disabled in Advanced mode
Solution: Enable the service in the metrics configuration

Update the extension

The GCP monitoring extension (com.dynatrace.extension.da-gcp) is installed from the Dynatrace Hub. Monitoring configurations are version-pinned—installing a newer extension version does not automatically migrate existing configurations. You must explicitly update them.

1. Check the latest installed version

EXT="com.dynatrace.extension.da-gcp"
LATEST=$(dtctl get extension "$EXT" --no-agent -o json \
  | jq -r '.[].version' | sort -V | tail -1)
echo "Latest installed: $LATEST"

2. Install a new version from Hub

# Install latest available
dtctl create extension --hub-extension "$EXT"

# Install a specific version
dtctl create extension --hub-extension "$EXT" --version 1.2.0

3. Migrate monitoring configurations to the new version

Migrate all monitoring configs

EXT="com.dynatrace.extension.da-gcp"
LATEST=$(dtctl get extension "$EXT" --no-agent -o json \
  | jq -r '.[].version' | sort -V | tail -1)

dtctl get extension-configs "$EXT" --no-agent -o json | jq -c '.[]' | while read -r cfg; do
  ID=$(echo "$cfg" | jq -r '.objectId')
  CURRENT=$(echo "$cfg" | jq -r '.value.version')

  if [ "$CURRENT" = "$LATEST" ]; then
    echo "SKIP $ID (already $LATEST)"
    continue
  fi

  echo "UPGRADE $ID: $CURRENT → $LATEST"
  TMPFILE=$(mktemp /tmp/extcfg_XXXXXX.json)
  echo "$cfg" | jq --arg v "$LATEST" '.value.version = $v' > "$TMPFILE"
  dtctl apply extension-config "$EXT" -f "$TMPFILE"
  rm "$TMPFILE"
done

Manage your GCP connections (Preview)

Latest Dynatrace
How-to guide
Published Feb 20, 2026
Preview

Connection visibility

A connection can see multiple Google Cloud projects. Use the Projects tab to view which projects are visible and monitored.

Connection health

Preview limitation

The health features are not yet available.

The Overview tab shows ingestion status for topology, metrics, and logs.

Edit a connection

To modify an existing connection

Go to the connections list in Settings > Collect and capture > Cloud and virtualization > Google Cloud (Preview).
Select the connection name, or select and choose Manage.
Modify the desired settings (metrics, filters, enrichment rules).
Select Save to apply changes.

Most changes take effect immediately. However, some changes require updates to your Google Cloud configuration:

Change	Google Cloud action required
Monitor additional projects	Grant service account `roles/viewer` on new projects
Monitor additional folders	Grant service account `roles/resourcemanager.folderViewer` on new folders
Enable log forwarding	Deploy log forwarding infrastructure (Terraform re-run or manual setup)
Enable or update asset inventory feeds	Deploy asset feed infrastructure or update them to reflect new asset types (Terraform re-run or manual setup)
Rotate Log Ingest token	Update the token in deployed Google Cloud infrastructure (Dataflow config)

Disable or enable a connection

You can temporarily disable a connection to stop data collection without deleting it.

To disable or enable a connection:

Go to the connections list in Settings > Collect and capture > Cloud and virtualization > Google Cloud (Preview).
Select on the right-hand side of the connection table.
Select Disable or Enable.

What happens when I disable a connection?

Dynatrace stops polling metrics and topology from Google Cloud
Log and asset inventory forwarding (if configured) continues until you disable the Google Cloud infrastructure
The connection configuration is preserved
Historical data already ingested remains in Dynatrace

When to use this?

Temporarily pause monitoring during maintenance windows
Troubleshoot issues without losing your configuration
Reduce costs when monitoring is not needed temporarily

To resume monitoring, enable the connection using the same menu.

Delete a connection

To delete a connection

Go to the connections list in Settings > Collect and capture > Cloud and virtualization > Google Cloud (Preview).
Select on the right-hand side of the connection table.
Select Delete and confirm.

What happens when I delete a connection?

Dynatrace stops polling metrics and topology from Google Cloud
Historical data already ingested remains in Dynatrace (subject to retention policies)
Google Cloud resources (service account, IAM bindings, forwarding infrastructure) are not automatically removed—you must clean these up manually or run terraform destroy.

Troubleshooting

Connection status: `Pending`

Connection status: `Unhealthy`

If a connection shows Unhealthy status, check the following

Symptom	Possible cause	Solution
Authentication failed	Service account doesn't exist	Verify service account was created in Google Cloud
Authentication failed	Dynatrace service account lacks impersonation rights	Grant `roles/iam.serviceAccountTokenCreator` to Dynatrace service account
Authentication failed	Domain-restricted sharing blocks Dynatrace	Add Dynatrace customer identity to allowed domains
No metrics data	Required APIs not enabled	Enable `monitoring.googleapis.com` API
No topology data	Required APIs not enabled	Enable `cloudasset.googleapis.com` and `cloudresourcemanager.googleapis.com` APIs
Partial data	Service account lacks permissions	Grant `roles/viewer` on all projects to monitor

Common issues

Connection stuck in `Pending` status

If a connection remains in Pending status, verify the following steps have been completed:

Google Cloud deployment: Ensure the Terraform scripts have been deployed or the manual setup is complete. See Manual onboarding reference for step-by-step instructions.

Monitoring configuration linked and enabled: Link the service account to the connection and enable monitoring:

dtctl enable gcp monitoring \
    --name "<configuration-name>" \
    --serviceAccountId "<service-account-email>"

IAM configuration: Verify that the service account exists, the required APIs are enabled, and the Dynatrace platform has impersonation rights. See the prerequisites for details.

"Permission denied" errors in the Health tab

The service account doesn't have sufficient permissions on the target projects/folders
Solution: Re-run Terraform or manually grant roles/viewer. If your organization requires more granular permissions, see the Grant permissions to the service account section in Manual onboarding reference for the exact IAM permissions list.

Connection is healthy but no data appears

Filters may be excluding all projects
Solution: Check folder/project filters in connection settings

Missing metrics for specific services

The service may be disabled in Advanced mode
Solution: Enable the service in the metrics configuration

Update the extension

1. Check the latest installed version

EXT="com.dynatrace.extension.da-gcp"
LATEST=$(dtctl get extension "$EXT" --no-agent -o json \
  | jq -r '.[].version' | sort -V | tail -1)
echo "Latest installed: $LATEST"

2. Install a new version from Hub

# Install latest available
dtctl create extension --hub-extension "$EXT"

# Install a specific version
dtctl create extension --hub-extension "$EXT" --version 1.2.0

3. Migrate monitoring configurations to the new version

Migrate all monitoring configs

EXT="com.dynatrace.extension.da-gcp"
LATEST=$(dtctl get extension "$EXT" --no-agent -o json \
  | jq -r '.[].version' | sort -V | tail -1)

dtctl get extension-configs "$EXT" --no-agent -o json | jq -c '.[]' | while read -r cfg; do
  ID=$(echo "$cfg" | jq -r '.objectId')
  CURRENT=$(echo "$cfg" | jq -r '.value.version')

  if [ "$CURRENT" = "$LATEST" ]; then
    echo "SKIP $ID (already $LATEST)"
    continue
  fi

  echo "UPGRADE $ID: $CURRENT → $LATEST"
  TMPFILE=$(mktemp /tmp/extcfg_XXXXXX.json)
  echo "$cfg" | jq --arg v "$LATEST" '.value.version = $v' > "$TMPFILE"
  dtctl apply extension-config "$EXT" -f "$TMPFILE"
  rm "$TMPFILE"
done

Manage your GCP connections (Preview)

Connection visibility

Connection health

Edit a connection

Disable or enable a connection

What happens when I disable a connection?

When to use this?

Delete a connection

What happens when I delete a connection?

Troubleshooting

Connection status: Pending

Connection status: Unhealthy

Common issues

Connection stuck in Pending status

"Permission denied" errors in the Health tab

Connection is healthy but no data appears

Missing metrics for specific services

Update the extension

Migrate all monitoring configs

Manage your GCP connections (Preview)

Connection visibility

Connection health

Edit a connection

Disable or enable a connection

What happens when I disable a connection?

When to use this?

Delete a connection

What happens when I delete a connection?

Troubleshooting

Connection status: Pending

Connection status: Unhealthy

Common issues

Connection stuck in Pending status

"Permission denied" errors in the Health tab

Connection is healthy but no data appears

Missing metrics for specific services

Update the extension

Migrate all monitoring configs

Connection status: `Pending`

Connection status: `Unhealthy`

Connection stuck in `Pending` status

Connection status: `Pending`

Connection status: `Unhealthy`

Connection stuck in `Pending` status