List assets

You can list your assets in Google Cloud projects, folders, or organizations.

Before you begin

Enable the Cloud Asset Inventory API in the project you're running Cloud Asset Inventory commands from.

Enable the Cloud Asset Inventory API
Make sure your account has the correct role to call the Cloud Asset Inventory API. For individual permissions for each call type, see Permissions.

Limitations

When listing BigQuery table data, not all fields are supported.
Frequently changing asset fields in BigQuery metadata such as numBytes, numLongTermBytes, numPhysicalBytes, and numRows are assigned null values.

List your assets

Console

The Google Cloud console uses the SearchAllResources API to request data, which means you can only view assets with the RESOURCE content type. To view other content types, or to filter by more precise criteria, use the gcloud CLI, REST, or a client library instead.

To list resource metadata for your project, folder, or organization, complete the following steps:

In the Google Cloud console, go to the Asset Inventory page.

Go to Asset Inventory
Change to the project, folder, or organization you want to list resources in.
Click the Resource tab.
In the Filter results panel, select the resource types, projects, or locations to filter the results by.
To view a resource's metadata, click the resource's display name in the results panel.

gcloud

gcloud asset list \
    --SCOPE \
    --asset-types=ASSET_TYPE_1,ASSET_TYPE_2,... \
    --content-type=CONTENT_TYPE \
    --relationship-types=RELATIONSHIP_TYPE_1,RELATIONSHIP_TYPE_2,... \
    --snapshot-time="SNAPSHOT_TIME"

Provide the following values:

SCOPE: Use one of the following values:
- project=PROJECT_ID, where PROJECT_ID is the ID of the project that has the asset you want to retrieve.
- folder=FOLDER_ID, where FOLDER_ID is the ID of the folder that has the asset you want to retrieve.
  How to find the ID of a Google Cloud folder
  Google Cloud console
  
  To find the ID of a Google Cloud folder, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher list box in the menu bar.
  
  Select your organization from the list box.
  
  Search for your folder name. The folder ID is shown next to the folder name.
  
  gcloud CLI
  
  You can retrieve the ID of a Google Cloud folder that's located at the organization level with the following command:
  
  gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
  
  Where TOP_LEVEL_FOLDER_NAME is a partial or full string match for the folder's name. Remove the --format flag to see more information about the found folders.
  
  The previous command doesn't return the IDs of subfolders within folders. To do so, run the following command using a top level folder's ID:
  
  gcloud resource-manager folders list --folder=FOLDER_ID
- organization=ORGANIZATION_ID, where ORGANIZATION_ID is the ID of the organization that has the asset you want to retrieve.
  How to find the ID of a Google Cloud organization
  Google Cloud console
  
  To find the ID of a Google Cloud organization, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher list box in the menu bar.
  
  Select your organization from the list box.
  
  Click the All tab. The organization ID is shown next to the organization name.
  
  gcloud CLI
  
  You can retrieve the ID of a Google Cloud organization with the following command:
  
  gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
ASSET_TYPE_#: Optional. A comma-separated list of searchable asset types. RE2-compatible regular expressions are supported. If the regular expression doesn't match any supported asset type, an INVALID_ARGUMENT error is returned. When --asset-types isn't specified, all asset types are returned.
CONTENT_TYPE: Optional. The content type of the metadata that you want to retrieve. When --content-type isn't specified, only basic information is returned, such as asset names, the last time the assets were updated, and what projects, folders, and organizations they belong to.
RELATIONSHIP_TYPE_#: Optional. Requires access to the Security Command Center Premium or Enterprise tier. A comma-separated list of asset relationship types that you want to retrieve. You must set CONTENT_TYPE to RELATIONSHIP for this to work.
SNAPSHOT_TIME: Optional. The time at which you want to take a snapshot of your assets, in gcloud topic datetime format. The value must be no more than 35 days in the past. When --snapshot-time isn't specified, a snapshot is taken at the current time.

See the gcloud CLI reference for all options.

Example

The following command gets a resource metadata snapshot of Compute Engine instances as of January 30, 2024 (2024-01-30) in the my-project project.

Before running this command, make sure to change the snapshot time to be within the last 35 days, and change the project name.

gcloud asset list \
    --project=my-project \
    --asset-types=compute.googleapis.com/Instance \
    --content-type=resource \
    --snapshot-time="2024-01-30"

Example response

---
ancestors:
- projects/000000000000
- folders/000000000000
- organizations/000000000000
assetType: compute.googleapis.com/Instance
name: //compute.googleapis.com/projects/my-project/zones/us-central1-a/instances/instance-name
resource:
  data:
    ASSET_METADATA
updateTime: '2024-01-30T00:00:00.000000Z'

REST

HTTP method and URL:

POST https://cloudasset.googleapis.com/v1/SCOPE_PATH/assets

Note: You can use a GET method for this request with parameters as a query string. However, the request URL is length limited, meaning the server rejects the request if the query string is too long. To avoid length restrictions, use a POST request instead, set a header of X-HTTP-Method-Override: GET, and use a JSON body for your parameters.

Request JSON body:

{
  "assetTypes": [
    "ASSET_TYPE_1",
    "ASSET_TYPE_2",
    "..."
  ],
  "contentType": "CONTENT_TYPE",
  "relationshipTypes": [
    "RELATIONSHIP_TYPE_1",
    "RELATIONSHIP_TYPE_2",
    "..."
  ],
  "readTime": "SNAPSHOT_TIME",
  "pageSize": "PAGE_SIZE",
  "pageToken": "PAGE_TOKEN"
}

Provide the following values:

SCOPE_PATH: Use one of the following values:

The allowed values are:
- projects/PROJECT_ID, where PROJECT_ID is the ID of the project that has the asset you want to retrieve.
- projects/PROJECT_NUMBER, where PROJECT_NUMBER is the number of the project that has the asset you want to retrieve.
  How to find a Google Cloud project number
  Google Cloud console
  
  To find a Google Cloud project number, complete the following steps:
  
  Go to the Welcome page in the Google Cloud console.
  
  Go to Welcome
  
  Click the switcher list box in the menu bar.
  
  Select your organization from the list box, and then search for your project name. The project name, project number, and project ID are shown near the Welcome heading.
  
  Up to 4,000 resources are displayed. If you don't see the project you're looking for, go to the Manage resources page and filter the list using the name of that project.
  
  gcloud CLI
  
  You can retrieve a Google Cloud project number with the following command:
  
  gcloud projects describe PROJECT_ID --format="value(projectNumber)"
- folders/FOLDER_ID, where FOLDER_ID is the ID of the folder that has the asset you want to retrieve.
  How to find the ID of a Google Cloud folder
  Google Cloud console
  
  To find the ID of a Google Cloud folder, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher list box in the menu bar.
  
  Select your organization from the list box.
  
  Search for your folder name. The folder ID is shown next to the folder name.
  
  gcloud CLI
  
  You can retrieve the ID of a Google Cloud folder that's located at the organization level with the following command:
  
  gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
  
  Where TOP_LEVEL_FOLDER_NAME is a partial or full string match for the folder's name. Remove the --format flag to see more information about the found folders.
  
  The previous command doesn't return the IDs of subfolders within folders. To do so, run the following command using a top level folder's ID:
  
  gcloud resource-manager folders list --folder=FOLDER_ID
- organizations/ORGANIZATION_ID, where ORGANIZATION_ID is the ID of the organization that has the asset you want to retrieve.
  How to find the ID of a Google Cloud organization
  Google Cloud console
  
  To find the ID of a Google Cloud organization, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher list box in the menu bar.
  
  Select your organization from the list box.
  
  Click the All tab. The organization ID is shown next to the organization name.
  
  gcloud CLI
  
  You can retrieve the ID of a Google Cloud organization with the following command:
  
  gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
ASSET_TYPE_#: Optional. An array of searchable asset types. RE2-compatible regular expressions are supported. If the regular expression doesn't match any supported asset type, an INVALID_ARGUMENT error is returned. When assetTypes isn't specified, all asset types are returned.
CONTENT_TYPE: Optional. The content type of the metadata that you want to retrieve. When contentType isn't specified, only basic information is returned, such as asset names, the last time the assets were updated, and what projects, folders, and organizations they belong to.
RELATIONSHIP_TYPE_#: Optional. Requires access to the Security Command Center Premium or Enterprise tier. A comma-separated list of asset relationship types that you want to retrieve. You must set CONTENT_TYPE to RELATIONSHIP for this to work.
SNAPSHOT_TIME: Optional. The time at which you want to take a snapshot of your assets, in RFC 3339 format. The value must be no more than 35 days in the past. When readTime isn't specified, a snapshot is taken at the current time.
PAGE_SIZE: Optional. The number of results to return per page. The maximum is 500. If the value is set to 0 or a negative value, an appropriate default is selected. A nextPageToken is returned to retrieve subsequent results.
PAGE_TOKEN: Optional. Long request responses are separated over multiple pages. When pageToken isn't specified, the first page is returned. Subsequent pages can be called by using the previous response's nextPageToken as the pageToken value.

See the REST reference for all options.

Command examples

The following commands get a resource metadata snapshot of Compute Engine instances as of January 30, 2024 (2024-01-30T00:00:00Z) in the my-project project.

Before running any of these commands, make sure to change the snapshot time to be within the last 35 days, and change the project name.

curl (Linux, macOS, or Cloud Shell)

curl -X POST \
     -H "X-HTTP-Method-Override: GET" \
     -H "Authorization: Bearer $(gcloud auth

List assets Stay organized with collections Save and categorize content based on your preferences.

Before you begin

Limitations

List your assets

Console

gcloud

Google Cloud console

gcloud CLI

Google Cloud console

gcloud CLI

Example

Example response

REST

Google Cloud console

gcloud CLI

Google Cloud console

gcloud CLI

Google Cloud console

gcloud CLI

Command examples

curl (Linux, macOS, or Cloud Shell)

List assets