Improve your security posture with asset insights

Cloud Asset Inventory insights can help to detect potential risks in your asset configurations, and help you to improve your security posture. It's part of the Recommender service, and is provided as the google.cloudasset.asset.Insight insight type.

Insights are specific anomalies which require further analysis to determine appropriate action. They are generated daily, based on a snapshot of the data stored in Cloud Asset Inventory.

The insights provided by Cloud Asset Inventory are based on the IAM policies associated with your organization's resources.

Before you begin

Before you can begin using asset insights, you must complete the following steps.

  1. Enable the Recommender API.

  2. Make sure that your account has the following permissions:

    • recommender.cloudAssetInsights.get

    • recommender.cloudAssetInsights.list

    • recommender.cloudAssetInsights.update

    You can grant these permissions individually, or you can grant one of the following roles.

    • Cloud Asset Insights Viewer (roles/recommender.cloudAssetInsightsViewer) role

    • Cloud Asset Insights Admin (roles/recommender.cloudAssetInsightsAdmin) role

Limitations

  • These insights don't consider group memberships or service accounts as part of their findings, and shouldn't be considered an exhaustive list of matching vulnerabilities.

  • Individual insights include a sampling of matching IAM policies capped at 100 distinct policies. All matching policies can be retrieved by searching for IAM allow policies on resources.

Request asset insights

The easiest way to request asset insights is to list them, as shown in the following steps. For other types of insights interactions, see Use the API - Insights.

gcloud

gcloud recommender insights list \
    --SCOPE \
    --location=global \
    --insight-type=google.cloudasset.asset.Insight \
    --filter="insightSubtype:SUBTYPE" \

Provide the following values:

  • SCOPE: Use one of the following values:

    • project=PROJECT_ID, where PROJECT_ID is the ID of the project you want insights for.

    • folder=FOLDER_ID, where FOLDER_ID is the ID of the folder you want insights for.

      How to find the ID of a Google Cloud folder

      Google Cloud console

      To find the ID of a Google Cloud folder, complete the following steps:

      1. Go to the Google Cloud console.

        Go to the Google Cloud console

      2. Click the switcher list box in the menu bar.
      3. Select your organization from the list box.
      4. Search for your folder name. The folder ID is shown next to the folder name.

      gcloud CLI

      You can retrieve the ID of a Google Cloud folder that's located at the organization level with the following command:

      gcloud resource-manager folders list \
    --organization=$(gcloud organizations describe ORGANIZATION_NAME