Google Cloud

Deploy the Sophos Remote Testing Appliance (RTA) as a virtual machine in your own Google Cloud project. We publish the appliance as a custom Compute Engine image in a Sophos-owned project and grant your Google account or project IAM access to launch VMs from it directly, with no image copy or download required.

What to send us first

We can only share the image once we know who to share it with. Send your engagement lead one of these Google identities:

Identity type	What to send	Who can then launch the RTA
Google account	The account's email, e.g. alex@example.com	That one person. Any Google account works, including Google Workspace, Cloud Identity, and Gmail accounts.
Google group	The group's email, e.g. gcp-admins@example.com	Every member of the group. You manage membership yourself, so you can add or remove people without coming back to us.
Service account	The service account's email, e.g. rta-deployer@your-project.iam.gserviceaccount.com	Automation that runs as that service account, such as Terraform or a CI pipeline.
Workspace or Cloud Identity domain	Your domain, e.g. example.com	Every user in your Google Workspace or Cloud Identity domain.

A Google group is usually the best choice

It keeps access to the people you choose and lets you change who is in it at any time. Choose a domain only if anyone in your organization may need to launch the RTA.

Share with the identity that creates the VM

Access goes to whoever creates the VM: the account signed in to the Cloud Console or running gcloud. Do not send the VM's own service account (such as the Compute Engine default PROJECT_NUMBER-compute@developer.gserviceaccount.com): a VM's attached service account plays no part in creating the VM. If your team signs in to Google Cloud through workforce identity federation rather than Google accounts, tell your engagement lead; those identities are not covered by the options above.

How delivery works on Google Cloud

Once the image is shared with the identity you sent us, your engagement lead provides:

Item	What it is
Source project	The Sophos-owned project that hosts the image: the --image-project value.
Image name	The name of the custom Compute Engine image, e.g. rta-generic-20250601.

Once we grant access, you launch a VM directly from our image. There is nothing to copy or upload. The image is generic: it has no engagement identity baked in, so on first boot the appliance comes up in activation mode and its console shows an Appliance Registration screen with a one-time activation code. Read the code from the serial console (you must enable the display device; see below) and give it to your Sophos engagement lead to activate the appliance. Once activated, it provisions itself, brings up the outbound VPN tunnel, and the console switches to the live status dashboard.

Enable the display device: it is off by default

GCP does not enable the virtual display device on new VMs unless you explicitly request it. Without it the RTA console is inaccessible. Check the Enable display device checkbox (Console) or pass --enable-display-device (CLI) every time you create an RTA instance.

The image project is outside your organization

The image project is Sophos-owned, not part of your GCP organization. The Console's source project picker defaults to your organization only, so you must switch the organization filter to "No organization" or "All" before searching for the project name your engagement lead provided. The CLI flag --image-project=IMAGE_PROJECT works without any extra steps.

Requirements

Resource	Minimum	Recommended
Machine type	2 vCPU / 8 GB (e2-standard-2)	e2-standard-4 (4 vCPU / 16 GB)
Boot disk	40 GB	40 GB
Networking	Outbound internet; no public IP / no inbound rules required	VPC subnet with VPN reach to engagement targets
Display device	Required (enable explicitly)	Required

Choose a deployment method

• GUI (Cloud Console)

  Point-and-click: create a VM instance in the Compute Engine console, selecting our shared image as the boot disk source.

• CLI (gcloud)

  One gcloud compute instances create command. The fastest path: no console navigation, no org-picker workaround needed.

• AI assistant (LLM)

  A copy-paste prompt that has your AI assistant drive the gcloud CLI deployment, pausing for your confirmation at each step.