Search resources under Google Cloud projects, folders or organizations using Cloud Asset Inventory API.

Syntax

Options

profile=STRING

Optional. Google Cloud connect profile. If multiple profiles are separated by commas, each profile is queried in turn and distinguished by the profile field. If not specified, all Google Cloud connect profiles you can use are queried. If an error occurs on a profile, rows already returned remain, the remaining profiles are skipped and the query ends with an error.

scope=STRING

Optional. projects/{id} (or projects/{number}), folders/{number} or organizations/{number}. Resources in the scope and below it (including sub folders and projects) are returned. Project of JSON key is used if not specified.

types=STRING

Optional. Comma separated asset types. Regular expression is supported. e.g. compute.googleapis.com/Instance, iam.googleapis.com/.*. All types are returned if not specified. See the asset type table in Description for common types.

query=STRING

Optional. Search query of Cloud Asset Inventory. e.g. labels.env:prod, location:asia-northeast3, name:sinks. Terms containing characters other than English letters and digits must be enclosed in double quotes, written as \" in the option value. e.g. query="tagKeys:\"dev-team\"". See Cloud Asset Inventory query syntax.

limit=INT

Optional. Max number of rows per profile. Positive integer. All rows are returned if not specified.

verbose=BOOL

Optional. Include versioned_resources and attached_resources. t, f, true or false (default: f)

Output fields

Error codes

Parse errors

Runtime errors

Description

Searches resource metadata in the scope using searchAllResources API of Cloud Asset Inventory. If an organization or folder is specified, resources in all folders and projects below it are returned. Results are fetched up to 500 at a time until the end.

The API returns the containing project as a number (projects/{number}) only. To make it readable, the command queries projects in the same scope once more and fills project_id and project_name. Folders and organization are returned as numbers only (folders, organization). To find their names, query with types="cloudresourcemanager.googleapis.com/(Folder|Organization)".

Specify IDs or numbers, not display names, in scope. Display names of folders and projects may be duplicated or changed, so specifying a name could query an unintended scope. Use the following query to find organization and folder numbers.

gcp-assets profile=gcp types="cloudresourcemanager.googleapis.com/(Organization|Folder|Project)"
| fields asset_type, display_name, name, organization

query is passed to Google Cloud as is without validation in the app. For an invalid query, Google Cloud returns an INVALID_ARGUMENT error with the cause, which is shown as the query error.

With verbose=t, the full configuration that differs by asset type is also returned, so the response gets larger. For a large scope, increase the read timeout of the connect profile or narrow the scope with types.

Common asset types

Frequently used asset types for the types option. See Supported asset types for the full list. An unknown or misspelled type causes a No supported asset type matches error.

Multiple types can be specified with a regular expression. e.g. types="compute.googleapis.com/.*" (all Compute Engine), types="iam.googleapis.com/.*" (all IAM)

Examples

Example: Asset types in the organization

Situation: Find what kinds of resources exist in the organization and how many.

gcp-assets profile=gcp scope=organizations/123456789012
| stats count by asset_type
| sort -count

Expected result:

Interpretation: Number of resources by asset type. serviceusage.googleapis.com/Service is an API enabled in each project. Use the types option to see a specific type only.

Example: Service accounts and keys

Situation: Review service accounts and service account keys in the organization by project.

gcp-assets profile=gcp scope=organizations/123456789012 types="iam.googleapis.com/.*"
| fields project_id, asset_type, display_name, name, create_time

Expected result:

Interpretation: Check for unused service accounts or old keys.

Example: Resources with a tag

Situation: Find resources that have a tag directly attached or inherited.

gcp-assets profile=gcp scope=organizations/123456789012 query="effectiveTagKeys:\"dev-team\""
| stats count by project_id, asset_type

Interpretation: The project the tag is attached to and all resources below it are returned. Use tagKeys: to find directly attached resources only.

Example: All projects in the organization including sub folders

Situation: scope of gcp-projects returns direct child projects only, so use this command to list all projects in the organization including sub folders.

gcp-assets profile=gcp scope=organizations/123456789012 types="cloudresourcemanager.googleapis.com/Project"
| fields project_id, display_name, folders, state, create_time

Interpretation: Folder numbers (folders) and state of each project are returned.