Connect a Google Cloud project: three paths

Connecting a project means granting a service account Bobbin created — yours, dedicated to your workspace, and named for it — four read-only IAM roles on the project, plus one Pub/Sub notification channel so your alerts reach us. There are three ways to apply that grant, and they apply exactly the same thing:

Path	Best for	Page
In the console	Teams who would rather click through a wizard than run anything	In the console
By script	An auditable gcloud script, readable before you run it	By script
With Terraform	IaC-native shops who would rather plan and apply	With Terraform

Being visibly indifferent to which one you pick is itself the point: all three derive from one specification, published in the public thoughtgears/bobbin-onboarding repository, which exists specifically to be read before it is run. There is no installer and no step that phones home.

What every path grants, and nothing more

Four Google-managed viewer roles, on the projects you choose:

Role	What it reads
roles/logging.viewer	Log entries
roles/monitoring.viewer	Metrics and alert policies
roles/errorreporting.viewer	Error groups
roles/run.viewer	Cloud Run service and revision configuration

That is the complete list. No path ever requests a write role, and Bobbin’s code has no code path that would use one if it existed. Alongside the roles, every path also creates one Cloud Monitoring notification channel, of type pubsub, named Bobbin (@bobby), pointing at the topic your workspace was given — that channel is what an alert policy notifies to reach Bobbin at all.

The known gotcha: domain-restricted sharing

If your organisation enforces the iam.allowedPolicyMemberDomains org policy, granting a service account from outside your domain fails with FAILED_PRECONDITION — and the raw error will not mention the policy by name. Every path handles this: the script and the console wizard detect it and print (or show) the exact exception steps; the Terraform module surfaces the same failure from apply. Add a conditional exception for the Bobbin organisation (your project’s own Support contact can give you the organisation id) or a project-level override, then retry — nothing already applied is lost. Google’s own documentation covers the exception mechanism in full.

After the grant: verify it

Applying a grant and Bobbin actually being able to read your project are two different claims — an org policy, a typo in a role name, or a channel pointing at the wrong topic can all make a grant look done and not work. The console checks the difference for you: see Verify access.

Removing access

Every path has an exact reverse — see the page for the path you used. You do not have to run it for your data to be deleted: Bobbin’s own side of the teardown (the service account that could read your project, your stored credentials) runs on our schedule within 30 days of you leaving, and does not wait for yours. Either half alone stops Bobbin reading anything.