[MUSIC PLAYING]
SOPHIA YANG: Hi, everyone.
I'm Sophia, product manager from Google Cloud.
I'm here today to tell you about Cloud Asset Inventory.
We all know by bringing workload to Cloud,
you're benefiting from its scalability, high performance,
secureness, and cost efficiency.
Yet at the same time, admins, especially platform admins,
security admins, are facing never-before-seen challenges
that were brought in by the large quantity of resources
and data that can be easily created by developers.
In fact, enterprises have millions of resources
running on Google Cloud today.
So how can you see all the things you
have on Cloud at the same time?
How can you keep an eye on all the changes
as they happen so you don't miss a threat?
How do you answer questions that seem simple but are actually
challenging, like how many VMs do I have in my org?
Who can change my billing accounts?
Or what service account keys that are older than 60 days?
I'm very excited to introduce you
to Cloud Asset Inventory, that aim to solve all
of these challenges for you.
As you can see here, Cloud Asset Inventory
is a fully managed metadata service.
So let's first address the elephant in the room--
what is an asset?
An asset can be a resource, like a VM instance, a BigQuery
table.
It can also be a policy, like IAM policy, org policy.
It can also be VM runtime information,
like system updates.
So now let's talk about metadata.
Metadata here means the configuration of an asset, not
the actual [INAUDIBLE] content.
For example, it is about the name, the size,
creation time for the disk, but not the files that
are written on the disks.
It offers many inventory services
on your entire GCP and Anthos environment, which
makes it truly a one-stop shop.
So you don't need to go to Compute Engine
to find all your VMs and then go to Cloud Storage
to see all your buckets, for example.
And what is more convenient than that,
it works at the organization, folder, and the project level,
with fine-grained IAM policy controls.
So regardless of your permission level,
you can always take full advantage of it.
Lastly, you can get up to 35 days of full change history
from Cloud Asset Inventory.
Now let's dive deeper into the features.
First and foremost, you can get a snapshot
of your entire inventory.
You can use either the Export or the List service.
The difference is that Export is a long-running operation, which
will export your data to either a Cloud Storage
Bucket or a BigQuery table, which makes it easier for you
to directly query and analyze data later.
List API works just like any other List API,
except it supports a timestamp, where all the data will
be included in the standard HTTP response in case
you don't want to deal with a storage location.
You can also get a full change history
by either using the UI or API, which I'll demo later.
Now, after getting full visibility
for your entire inventory plus history,
we also offer a real-time notification feature for you
to easily achieve continuous monitoring.
It allows you to monitor assets, and will send a Pub/Sub message
when change occurs.
You can define your criteria as a name, as a type,
or by org, folder, and project.
You can even use CEL condition.
By the way, CEL is the expression language
created by Google.
For example, you can say, notify me as soon as any of our rules
got changed in my org, or notify me
only if IAM policy is changed to be open, or one of the VMs
deleted.
Here's an example scenario.
An admin wants to monitor and get
notified when a Gmail account is added to an IAM policy.
You first define your condition in a real-time feed
using the code shown below.
Now if a malicious user adds his own Gmail account
into the policy, Cloud Asset Inventory
will trigger a Cloud Pub/Sub message right to you
in real-time.
From there, you can define all remediation actions.
For example, you can write a Cloud Function
to roll back the change or send an email to project owners.
The real-time monitoring capability,
especially the conditions supported through CEL,
ensures that you won't miss any important changes,
and also filters out the noises so you
can stay focused and keep your costs low.
OK, now.
If you're one of the policy admins or privacy
admins who have to be on top of access grants,
take care of access certificate, and keep track
of all the changes across a whole org,
you will be really excited to learn a powerful tool offered
by Cloud Asset Inventory--
IAM Policy Analyzer.
In a nutshell, it does deep and thorough analysis on policies
and related resources to help you answer the question, who
can access what and why?
For example, what service accounts
can access my Buckets that contain sensitive data,
or what access does this terminated employee still have?
So what makes the tool powerful?
Let me show you with an actual example.
Who can change my firewall rules?
This is one of the top questions admin need
to answer and keep track to.
Well, it turns out you have to peel through many layers
to actually get to the full picture,
starting from the "who" part.
"Who" can be a user, a group, or even a service account.
In the case of group, there can be multiple layers of groups,
which we call nested groups.
In case of a service account, there
can also be multiple layers of service accounts
that can impersonate one another.
Policy Analyzer can handle all of the above to give you
a complete picture on the "who" part.
Now let's look at what's needed for changing a firewall rule.
Turns out three permissions-- create, update, or delete--
can all make changes in firewalls in some ways.
Policy Analyzer is capable of mapping IAM rules
to permissions for both curated roles and custom roles.
At last, let's look at the last part
of the question, project A. We all
know IAM policies can be inherited,
which requires you to not only look at IAM policy
through our client project A here,
but also trace up along the hierarchy to the folders
and to the orgs above to make sure all of the policies
are analyzed.
Luckily, Policy Analyzer analyzes
resource and the policy hierarchy as well.
It also analyzes IAM conditions and exports results
to Cloud Storage Buckets or BigQuery table.
So here you go.
You can see how much work the Policy Analyzer does
for you behind the scene in order
to provide a truly complete and comprehensive answer on who
can access what and why.
Now it's the demo time.
As I mentioned earlier, let's take a quick look
at the Cloud Asset Inventory Developer Console.
The Cloud Asset Inventory Developer Console
is located under the IAM and Admin tab.
First you can use a tag on the top
to switch between org, folder, or project that you would
like to see your assets at.
Once landed on the landing page, you
will see an Overview tab with automatically
pre-populated dashboards for your deployment insights;
also resource and policy tabs for details about assets.
The first geograph shows you how your zonal and regional
resources are located across the globe.
You can also get to a table view of it.
The next one shows how your VM instance counts
have been changing over time.
And the next view shows you the resource counts
by services and asset types.
You can also use the predefined filters
on the left to focus only on assets
that you are interested in, like VM instances.
As you can see, I have 17, and they all
live in a US Central region.
Click anywhere on the dashboard--
it will take you to the corresponding resource IAM
Policy tab.
You can see here all the filter options are carried over
from the graph setting before, so let's uncheck them.
Let's assume I want to search for certain VM instances.
So I can first check on the asset type here.
And then I will further refine my search results
by typing the search term into the search bar,
like name contains the instance and label
key contains color group.
And here are my results.
I can also search by directly typing in certain asset
attribute values, like a [INAUDIBLE] IP, as that's
what I found on the internet and I
want to locate which VM it is.
And here you go.
I found my VM.
I can then click on the instance to see the Detail page.
You can see the high-level summary first.
Also, if Compute Engine VM Manager is enabled,
you can see the runtime information as well,
like OS version, kernel, running or stopped.
You can go to the Change History tab
to see the full change history up to 35 days.
You can see here all the timestamp shows
ones that had a metadata change, and I can choose two timestamps
to compare the differences.
In this case, I can see that a label, color group pink,
was removed between the two versions, as well
as some other change.
Next, you can go to the Full Metadata tab
for all the details, like description, disk,
service account, et cetera.
And lastly, you can see the IAM policy
that's attached to the resource in the IAM Policy tab.
That is all for today, and we encourage all of you
to try it out.
Check out the documentation product pages down below.
And we're looking forward to hearing from all of you.
Thank you very much for watching.
[MUSIC PLAYING]