PRASHANT KULKARNI: Welcome to the Google Cloud Security
Showcase, a special web series where
we'll focus on security use cases
that customers can solve with Google Cloud.
My name is Prashant Kulkarni, and I am a customer engineer
at Google Cloud.
Today we'll be walking through one of the top questions
we get from customers-- how do I do reporting and access
reviews on GCP?
Google Cloud has something we call Cloud Asset Inventory API.
Asset Inventory API allows you to search asset metadata
by using a custom query language,
export all asset metadata at a certain time stamp,
or export event change history during a specific timeframe.
It also allows you to monitor asset changes by subscribing
to real time notifications.
Now before we dive into this, there
are some terms that we should get familiar with.
Assets-- an asset refers to a Google Cloud
resource or policy.
Cloud Asset Inventory supports two main asset content types.
Resources, resource metadata off a Google Cloud Asset.
Examples include compute engine, virtual machines, cloud storage
buckets, app engine instances, and so on.
And policies.
Policies are metadata of one of the following policies
set on Google Cloud resource.
Examples include Cloud IM policy, organization policy,
access context manager policy.
Now to be able to extract out the policy,
you could run G Cloud asset command.
G Cloud Asset Search All IAM policies
will give you what you need.
Now wouldn't it be cool to be able to export this data?
Google Cloud provides two ways to export this data.
One is export the data to Google Cloud Storage,
or export the data to BigQuery.
We're going to look at BigQuery export.
So for example, this is my Asset Inventory API project.
Here, I have created a project for BigQuery
called Asset Inventory API.
Within that, I have a dataset called IM Asset Inventory.
And within IM Asset Inventory dataset,
IM Policy Inventory table.
Now to be able to do that, you will actually
run a command called G Cloud Asset Export.
In this command, you will provide an organization
ID, which is your unique idea given to your Google Cloud
organization, a BigQuery table--
this is the full resource for BigQuery table--
output BigQuery force.
And then content type equal to IM policy.
This is the most important flag.
This tells the Cloud Asset Inventory
API to export IM policies for your organization.
This command runs in asynchronous mode,
and when you run it, it will provide you a job ID.
You can actually monitor the status of the job ID
by using this command.
G Cloud Asset operations describe.
Now this will actually provide you a flag called Done.
When the flag value is set to True,
that means your export is completed.
Now let's look at the table that is formulated by this export.
The job basically finished.
I had it exported a while back.
The results are here.
So for example, if I run a command to get a high level
overview of all my asset and asset types, I will run this.
For example here, the output will
show you one snapshot of all the asset types within your cloud
organization and how many of those
types exist to provide you a one level view of everything
that you need to worry about.
Now if I need to find out who has access to what,
I will run a second SQL command.
And let me show you that.
This command basically shows you all the user accounts
that have access to your different assets within Google
Cloud.
And here we go.
All the members that have access to [? keyword ?] asset types
are included.
And you could actually look at the projects,
within the projects, what particular asset type this user
has access to.
Now if you want to take access report of service accounts,
you could actually do that as well.
So I will modify this command to include service account.
So when I run this, this will show us
all the service account that has access to your project.
Basically two things-- each service
account that exists within your project,
and all the service accounts that exist
within your organization.
Now wouldn't it be cool if we also get access
to information like which group has access to your environment?
Let's just modify this command to get that report.
Here is output of all the groups that
have access to your different datasets
within different projects.
You can export this information in a CSV format.
You can actually use a data visualization product
that you like to make sense of this data.
Or you can export this within your identity governance
product to be able to perform access reviews.
Thank you for tuning in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.