Cloud Asset Inventory and Gemini Cloud Assist

• It keeps create, update, and delete history for 35 days. Assets with no changes in that time return their latest status.
• Metadata comes from resources (VMs, buckets, App Engine instances…), from policies (IAM, organization, Access Context Manager), and from OS inventory management runtime information.
• It also lets you analyze what would happen if a resource moved to another project and view effective IAM policies: who has access to what.

Content types

When you query, you specify which metadata you want. Without a content type you get only the basics: asset name, last update, and its ancestors (project, folders, organization).

Setting it up: API and roles

Listing and searching resources and policies

In the console, the Asset Inventory page has a Resource tab where you filter with the search syntax, see the equivalent gcloud query (View query), and download the results as CSV.

# List a project's Compute Engine assets
gcloud asset list --project=PROJECT_ID --asset-types=compute.googleapis.com/Instance

# Search resources in an organization
gcloud asset search-all-resources --scope=organizations/ORG_ID --query="location:us-central1"

# Search IAM policies that grant public access
gcloud asset search-all-iam-policies --scope=organizations/ORG_ID \
  --query="memberTypes:(allUsers OR allAuthenticatedUsers)" --format="table(resource)"

• Searches are synchronous and consume quota; for large inventories, use asynchronous methods such as export.
• Not every resource type is searchable: the resource types documentation shows which ones the search APIs support.
• A tip from the docs: run a search with no query first and use the fields in the response to build your filter.

Exporting to BigQuery or Cloud Storage

An export takes a snapshot of the organization, folder, or project (it can be from a past date, up to 35 days back) to analyze with SQL in BigQuery or store in Cloud Storage.

gcloud asset export --project=my-project --content-type=resource \
  --snapshot-time="2024-01-30" \
  --bigquery-table=projects/my-project/datasets/my-dataset/tables/my-table

• With --per-asset-type you get one table per asset type, with columns for the nested fields.
• You can't append to an existing table unless it is partitioned: the table must be empty or overwritten with --output-bigquery-force.
• Clustered tables aren't supported, and some frequently changing fields, such as numRows, may be exported as null.

Feeds: real-time change notifications

A feed sends a notification to a Pub/Sub topic whenever the resources, IAM policies, access policies, or organization policies you choose change in an organization, folder, or project. You can add conditions so you only get certain kinds of changes.

gcloud asset feeds create my-feed --project=my-project \
  --pubsub-topic=projects/my-project/topics/my-topic \
  --asset-names=//storage.googleapis.com/my-bucket --content-type=iam-policy

• The first message is a welcome message; the rest are TemporalAsset objects with the new state and the previous one (priorAsset).
• Google suggests connecting notifications to your workloads, for example a Cloud Run function that reverts an unauthorized change.

What is Gemini Cloud Assist?

It uses as context your project and organization IDs, the console page you are viewing (URL and visible text), and session memory. Several of its features are in preview. Like any generative AI, it can produce plausible but incorrect output: Google recommends validating everything it generates.

Setting up Gemini Cloud Assist

An administrator sets it up for a project or folder before the team can use it.

gcloud services enable geminicloudassist.googleapis.com --project PROJECT_ID
gcloud services enable cloudasset.googleapis.com designcenter.googleapis.com \
  appoptimize.googleapis.com apphub.googleapis.com --project PROJECT_ID

What it can do

Where you use it

Exam scenarios

Common exam traps