GCP for DevOps — Cloud Asset Inventory

Cloud Asset Inventory

Cloud Asset Inventory (CAI) provides a complete catalog of your GCP resources, IAM policies, and organization policies. It enables search, export, change tracking, and compliance auditing across your entire organization.

What CAI Tracks

Cloud Asset Inventory Scope:
┌────────────────────────────────────────────┐
│  Organization                               │
│  ├── Folders                                │
│  │   ├── Projects                           │
│  │   │   ├── Compute instances              │
│  │   │   ├── GKE clusters                   │
│  │   │   ├── Cloud SQL instances            │
│  │   │   ├── Cloud Storage buckets          │
│  │   │   ├── IAM policies                   │
│  │   │   ├── Firewall rules                 │
│  │   │   ├── Service accounts               │
│  │   │   └── ... (all resource types)       │
│  │   └── ...                                │
│  └── Organization policies                  │
└────────────────────────────────────────────┘

Search Assets

# Search for all Compute Engine instances
$ gcloud asset search-all-resources \
    --scope=projects/my-project \
    --asset-types=compute.googleapis.com/Instance

# Search by name pattern
$ gcloud asset search-all-resources \
    --scope=projects/my-project \
    --query="name:*prod*"

# Search across an organization
$ gcloud asset search-all-resources \
    --scope=organizations/123456789 \
    --asset-types=storage.googleapis.com/Bucket \
    --query="location:us-central1"

# Search IAM policies
$ gcloud asset search-all-iam-policies \
    --scope=projects/my-project \
    --query="policy:roles/owner"

Export Assets

# Export all resources to Cloud Storage
$ gcloud asset export \
    --project=my-project \
    --output-path=gs://my-assets-bucket/export.json \
    --content-type=resource

# Export to BigQuery
$ gcloud asset export \
    --project=my-project \
    --bigquery-table=projects/my-project/datasets/assets/tables/resources \
    --content-type=resource \
    --output-bigquery-force

# Export IAM policies
$ gcloud asset export \
    --project=my-project \
    --output-path=gs://my-assets-bucket/iam-policies.json \
    --content-type=iam-policy

Asset Change History

# Get change history for a specific resource
$ gcloud asset get-history \
    --project=my-project \
    --asset-names="//compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/my-vm" \
    --content-type=resource \
    --start-time="2026-03-01T00:00:00Z" \
    --end-time="2026-03-30T23:59:59Z"

Real-Time Feeds

Monitor resource changes in real time:

# Create a feed for Compute Engine changes
$ gcloud asset feeds create vm-changes \
    --project=my-project \
    --asset-types=compute.googleapis.com/Instance \
    --content-type=resource \
    --pubsub-topic=projects/my-project/topics/asset-changes

# Create a feed for IAM policy changes
$ gcloud asset feeds create iam-changes \
    --project=my-project \
    --content-type=iam-policy \
    --pubsub-topic=projects/my-project/topics/iam-changes

# List feeds
$ gcloud asset feeds list --project=my-project

Analyze with BigQuery

After exporting to BigQuery, run compliance queries:

-- Find all public Cloud Storage buckets
SELECT name, resource.data.iamConfiguration.publicAccessPrevention
FROM `my-project.assets.resources`
WHERE asset_type = 'storage.googleapis.com/Bucket'
  AND resource.data.iamConfiguration.publicAccessPrevention != 'enforced';

-- Find VMs without labels
SELECT name, resource.location
FROM `my-project.assets.resources`
WHERE asset_type = 'compute.googleapis.com/Instance'
  AND resource.data.labels IS NULL;

-- Find service accounts with owner role
SELECT DISTINCT member
FROM `my-project.assets.iam_policies`,
  UNNEST(iam_policy.bindings) AS binding,
  UNNEST(binding.members) AS member
WHERE binding.role = 'roles/owner'
  AND member LIKE 'serviceAccount:%';

Common Mistakes

Mistake	Why It’s Wrong	Fix
No asset inventory	Can’t audit what you have	Enable CAI and export regularly
Project-only scope	Missing org-wide view	Search at organization scope
No real-time feeds	Changes go unnoticed	Create feeds for critical asset types
Not using BigQuery	Can’t do complex queries	Export to BQ for analytics
Ignoring IAM policy export	Can’t find over-permissioned access	Export and analyze IAM policies

Quick Reference

Command	Description
gcloud asset search-all-resources	Search resources
gcloud asset search-all-iam-policies	Search IAM policies
gcloud asset export	Export to GCS/BigQuery
gcloud asset get-history	View change history
gcloud asset feeds create	Create real-time feed

Next → Policy Analyzer