[MUSIC PLAYING]
SUNNY RISSLAND: Welcome to the "Google Cloud Security
Showcase", A special web series where
we'll focus on security use cases
that customers can solve with Google Cloud.
My name is Sunny and I'm a product manager
at Google Cloud.
Today we'll be walking through one of the top questions we get
from customers, how do I use Cloud Asset inventory
to gain visibility into my Google Cloud environment?
Cloud provides a number of benefits,
including scalability, high performance, and flexibility,
but the rapid growth that often follows
can make it more difficult for DevOps and security admins
to know what exists within their organization, projects,
and folders at any given time.
And that's exactly where Cloud Asset inventory can help.
Now, let's dive into a quick demo of Asset Inventory.
For the purpose of this demo, let's
pretend that I'm a GCP admin and I
need to identify all of the compute instances that
were created after January 1 in a couple of specific zones.
I could do this using the Cloud Asset API,
but today, I'm going to use the Asset Inventory UI.
I'm already on the Asset Inventory page,
which can be found by navigating to IAM & Admin
within the GCP admin console.
On the Asset Inventory overview page,
I can see a high level view of my entire organization,
including a heat map of zones where my assets are located.
I could click on a zone to view all of the assets
within that zone, but I need to look at two.
So, instead I'm going to click the Resource tab
and begin my search there.
I only want to see compute instances.
So, we'll start by scoping my search
to just those by selecting compute instances
from the asset type list.
You'll notice it's not displayed here,
and that's because this list is ordered
highest to lowest by quantity.
So, I'm going to click View More and select Compute Instances
from that list instead.
Now, I could manually select the attributes
I'm looking for from the panel on the left,
but instead I'm going to use the search functionality.
I'll begin by searching for the locations that I want to see,
us-central1-a and us-east1-b.
One thing to note is that asset search
supports both and/or operators.
And is assumed, unless you enter the OR operator, which
I want because I want to see assets in either zone.
So, I'm going to select OR.
So once I have those locations applied,
then I'll filter and create time.
In this case, I want to see everything that was created
after January 1 of this year.
Let's get that entered.
And OK, so, it looks I have quite a few that fit the bill.
If I wanted to, I could download a CSV of the results
for further analysis.
But we're just going to scrub through and look
at some of the asset metadata associated
with one of these resources.
OK, so, looking at the Summary tab,
we can see a lot of information about the resource,
including its creation date, the project it's contained in,
and its parent asset type and name.
Below that there's some information about the instance,
including its internal IP, machine type, and zone.
And if VM Manager were enabled, I
could also see additional machine metadata, including
the OS version of the VM and versions
of any installed packages.
Moving on to the Change History tab,
I can review when and what changes
have been made to this resource within the last five weeks.
Looking at the timeline, I can see
that a few changes have occurred since the resource was created.
So, let's have a look at what happened.
I'm going to select the latest record and the record
from when the resource was created.
It looks like the CPU information was populated
after the instance came online.
I also see that the fingerprint and IP changed
and that the machine status switched
from provisioning to running.
These changes look pretty innocuous,
but if I wanted to monitor this resource,
I could create a Pub/Sub notification that
would alert me to changes to the resource or a set of resources.
On the phone metadata tab, I can see all the metadata
captured for this resource.
There's a lot of information here, including fingerprints,
configure network interfaces, service accounts,
and other configuration data, like the Debian license
attached to the instance.
If I wanted to find something specific, like the asset type,
I could use the search functionality
at the top to narrow my scope.
And lastly, on the IM policy's tab,
if there were policies that were scoped for this resource,
I would be able to view them here.
This concludes the Security Showcase demonstration
on Cloud Asset inventory.
Thank you for tuning in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.
[MUSIC PLAYING]