Profile Applicability:
Level 1
Description:
Google Cloud Asset Inventory (CAI) provides a historical view of Google Cloud resources and IAM policies through a time-series database. It captures metadata about resources, IAM policies, and runtime information within a project. While the Cloud Asset API is not required for basic operation of CAI, enabling it allows for searching and exporting data directly.
Rationale:
Cloud Asset Inventory facilitates:
Security analysis: Identifying misconfigurations and vulnerabilities.
Resource change tracking: Monitoring changes over time.
Compliance auditing: Ensuring adherence to organizational and regulatory requirements.
Enabling CAI ensures an accurate inventory of assets and IAM policies, which is critical for governance and security.
Impact:
Enabling CAI does not impact regular operations but enables enhanced tracking.
Organizations might incur storage costs when exporting asset metadata to Cloud Storage or BigQuery.
Audit Steps:
Using Google Cloud Console:
Navigate to API & Services > Library by visiting:
https://console.cloud.google.com/apis/library.
Search for Cloud Asset API and select the result.
Verify that API Enabled is displayed.
Using Google Cloud CLI:
Run the following command to check if the Cloud Asset API is enabled:
gcloud services list --enabled --filter=name:cloudasset.googleapis.com
If the API is enabled, it will be listed in the output. If the response is empty, the API is not enabled.
Remediation Steps:
Using Google Cloud Console:
Navigate to API & Services > Library by visiting:
https://console.cloud.google.com/apis/library.
Search for Cloud Asset API and select it.
Click the ENABLE button.
Using Google Cloud CLI:
Enable the Cloud Asset API by running the following command:
gcloud services enable cloudasset.googleapis.com
References:
Additional Information:
CAI retains a five-week history of asset metadata by default. For longer retention, consider exporting data to Cloud Storage or BigQuery.
Users do not need to enable the API unless they plan to export or search CAI data directly.