This page explains how to use Cloud Asset Inventory to monitor your secrets, export data for analysis, and run powerful queries to get the insights that you require.
Overview
Cloud Asset Inventory analyzes your Google Cloud environment and records any changes to your cloud resources, such as virtual machines, databases, storage buckets, and in this context, your Secret Manager secrets. The integration between Secret Manager and Cloud Asset Inventory helps you do the following:
-
Run queries: Search for specific secrets or identify patterns across your secrets.
-
Set up alerts: Configure Cloud Asset Inventory to send notifications to Pub/Sub when specific events occur, such as when secrets are created, modified, or deleted.
-
Export data: Export your secret inventory to BigQuery for in-depth analysis and reporting.
-
Manage and analyze your secrets: See all your secrets in one place (across projects and your entire organization) and identify secrets that might be misconfigured or violate your organization's security policies. For example, you can find secrets that are not rotated regularly or lack proper access controls.
This is an advanced task for Secret Manager users. Before reading this page, we recommend that you read the following:
-
Secret Manager overview to understand the key concepts and features of Secret Manager
-
Cloud Asset Inventory overview to understand Cloud Asset Inventory and to see its comprehensive asset management features
Querying Secret Manager
To analyze your secrets with SQL-like queries, we recommend that you export your secret and secret versions to BigQuery. Secret Manager isn't integrated with Asset Search or Policy Analyzer. These queries use the Google Cloud CLI and BigQuery to search your assets.
Limitations
Using Cloud Asset Inventory to analyze Secret Manager resources has the following limitation:
- Cloud Asset Inventory supports exporting and listing snapshots for only the past five weeks.
- Secret Manager data is synchronized with Cloud Asset Inventory every 7 hours. If a sync fails, freshness is delayed until the next successful sync. For use cases requiring real-time information, query the Secret Manager API instead.
Monitor asset changes
Cloud Asset Inventory tracks updates and supports monitoring these changes. You can configure feeds to send notifications to a set of configured Pub/Sub topics each time there's a modification to your resources. Additionally, Cloud Asset Inventory supports configuring conditions on your feeds, so that you can monitor specific changes for certain asset types. To learn how to trigger workflows on asset changes, see the Pub/Sub documentation.
Export assets to BigQuery
Exporting your secrets and secret versions to BigQuery lets you run SQL-like queries over large amounts of data and produce meaningful insights about your assets. Before you export your assets, ensure that your dataset and service accounts are configured correctly.
To export your assets, run the following command:
gcloud
Before using any of the command data below, make the following replacements:
- CONTENT_TYPE: the asset content type (
RESOURCE). - PROJECT_ID: the ID of the project containing the secrets to be analyzed.
- SNAPSHOT_TIME: the time at which to snapshot resources. This may be between the current time and 5 weeks in the past.
- BIGQUERY_PROJECT_ID: the ID of the project that the BigQuery table is in.
- DATASET_ID: the ID of the BigQuery dataset.
- TABLE_NAME: the table you're exporting your metadata to. If it doesn't exist, it's created.
Execute the following command:
Linux, macOS, or Cloud Shell
gcloud asset export \ --content-type=CONTENT_TYPE \ --project=PROJECT_ID \ --snapshot-time=SNAPSHOT_TIME \ --bigquery-table=projects/BIGQUERY_PROJECT_ID/datasets/DATASET_ID/tables/TABLE_NAME \ --output-bigquery-force