Skip to main content

lacework-global-256

2.13 Ensure Cloud Asset Inventory Is Enabled (Automated)​

Profile Applicability​

• Level 1

Description​

GCP Cloud Asset Inventory is services that provides a historical view of GCP resources and IAM policies through a time-series database. The information recorded includes metadata on Google Cloud resources, metadata on policies set on Google Cloud projects or resources, and runtime information gathered within a Google Cloud resource.

Rationale​

The GCP resources and IAM policies captured by GCP Cloud Asset Inventory enables security analysis, resource change tracking, and compliance auditing.

Impact​

It is recommended GCP Cloud Asset Inventory be enabled for all GCP projects.

Audit​

From Console: Ensure that the Cloud Asset API is enabled:

  1. Go to API & Services/Library by visiting https://console.cloud.google.com/apis/library
  2. Search for Cloud Asset API and select the result for Cloud Asset API
  3. Ensure that API Enabled is displayed.

From Command Line: Ensure that the Cloud Asset API is enabled:

  1. Query enabled services:
gcloud services list --enabled --filter=name:cloudasset.googleapis.com

If the API is listed, then it is enabled. If the response is Listed 0 items the API is not enabled.

Remediation​

From Console: Enable the Cloud Asset API:

  1. Go to API & Services/Library by visiting https://console.cloud.google.com/apis/library
  2. Search for Cloud Asset API and select the result for Cloud Asset API
  3. Click the ENABLE button.

From Command Line: Enable the Cloud Asset API:

  1. Enable the Cloud Asset API through the services interface:
gcloud services enable cloudasset.googleapis.com

References​

https://cloud.google.com/asset-inventory/docs

Additional Information​

  • Cloud Asset Inventory only keeps a five-week history of Google Cloud asset metadata. If a longer history is desired, automation to export the history to Cloud Storage or BigQuery should be evaluated.