This topic shows you how to query the asset metadata for your project, folder, or organization without needing to export the data to a BigQuery table first.
Limitations
The query provided in the request must be a
SELECT
query.Query results larger than 10GB are not supported.
Query results larger than 10MB or 1000 rows are always paginated.
Legacy BigQuery SQL isn't supported.
Query results can only be saved in a BigQuery dataset in the
US
multi-region.For new subscriptions to Security Command Center Premium tier, it can take up to 6 hours to get access to the API, and up to 48 hours for historical data to be ready.
Before you begin
Before you begin, complete the following steps.
Enable the Cloud Asset Inventory API on the project where you'll be running the API commands.
Configure the permissions that are required to call the Cloud Asset Inventory API using either the gcloud CLI or the API.
Complete the following steps to set up your environment.
gcloud CLI
To set up your environment to use the gcloud CLI to call the Cloud Asset Inventory API, install the Google Cloud CLI on your local client.
REST
To set up your environment to call the Cloud Asset Inventory API with the
curl
command, complete the following steps.Confirm that you have access to the
curl
command.Ensure that you grant your account one of the following roles on your project, folder, or organization.
Cloud Asset Viewer role (
roles/cloudasset.viewer
)Owner basic role (
roles/owner
)
If you are exporting metadata from one project to another, make sure the exporting project's default Cloud Asset Inventory service account exists and has the correct permissions.
Permissions
The following list shows the permissions required for each ContentType in a request.
Content type | Permission | |
---|---|---|
gcloud name | REST name | |
access-policy |
ACCESS_POLICY |
cloudasset.assets.queryAccessPolicy |
iam-policy |
IAM_POLICY |
cloudasset.assets.queryIamPolicy |
os-inventory |
OS_INVENTORY |
cloudasset.assets.queryOSInventories |
relationship |
RELATIONSHIP |
cloudasset.assets.queryResource |
resource |
RESOURCE |
cloudasset.assets.queryResource |
The role you grant when you configure permissions
(cloudasset.viewer
or cloudasset.owner
) contains these permissions.
Format a query
The Query Assets API requires that queries use a BigQuery Standard SQL-compatible dialect.
When querying for an asset, its name must follow a specific format. For example,
a query looking for VMs would query for compute_googleapis_com_Instance
.
Learn more about supported asset types.
Names used in a query are transformed - /
and .
are replaced with _
(for
example, compute.googleapis.com/Instance
becomes
compute_googleapis_com_Instance
).
Table names in the dataset correspond to the asset type name. For content whose
content_type
is not RESOURCE
, the table name is the content type in upper
case (for example, IAM_POLICY
, OS_INVENTORY
, ACCESS_POLICY
).
To query resource standard metadata across resource types, the table name is
STANDARD_METADATA
. The supported resource metadata includes all fields except
resource.DATA
, which is specific to a resource type.
You can refer to the schemas used by various assets in the Asset Inventory page in the Google Cloud console.
Field value response format
In a response, the schema
and rows
fields are similar to those in the
BigQuery. Field metadata
is relegated to a separate struct named schema
. This format helps compress a
potentially very large response by avoiding field name and type duplication. The
values f
and v
are used instead of fields
and value
for the same reason.
This sample shows the response to a query for all assets of a given type with
page-size
of 2:
{
"jobReference": "CiBqb2JfTHhIQ2xCeXlJejc1bHdQSTRNZ3NEVndXU2o5QxIBARjLq-_g5fO5t1I",
"done": true,
"queryResult": {
"rows": [
{
"f": [
{
"v": "//compute.googleapis.com/projects/PROJECT1/zones/us-central1-a/instances/INSTANCE1"
},
{
"v": "compute.googleapis.com/Instance"
}
]
},
{
"f": [
{
"v": "//compute.googleapis.com/projects/PROJECT2/zones/us-central1-a/instances/INSTANCE2"
},
{
"v": "compute.googleapis.com/Instance"
}
]
}
],
"schema": {
"fields": [
{
"field": "name",
"type": "STRING",
"mode": "NULLABLE",
"fields": []
},
{
"field": "assetType",
"type": "STRING",
"mode": "NULLABLE",
"fields": []
}
]
},
"nextPageToken": "BHKVJIOAPUAQAAASA4EAAEEAQCAAKGQIBABBB7X7777QOIFQVYKQ====",
"totalRows": "11"
}
}
Query in Google Cloud console
Console
To query the asset metadata for your project, folder, or organization, complete the following steps:
Go to the Asset Inventory page in the Google Cloud console.
To set the scope for your search, select a project, folder, or organization.
Click the Asset query tab.
To query asset metadata, either use a sample query or build your own:
To use a sample, click an entry in the Query library tab to preview the query. Click Apply to copy that sample into the Edit query box, then either edit the query, or click Run to execute it.
To build your own query, enter the query text directly into the Edit query box, then click Run to execute it. To assist in writing your own query, you can click a table in the Select table pane to preview its schema and content. Learn more Query syntax.
The asset metadata matching the query is shown in the Query result tab.
Optional: To download the query result sets in CSV format, click Export.
The maximum size of the CSV file is 2 MB. If the download request fails because the file size exceeds this limit, a message appears with instructions for exporting the full results.
Save query results
Query results are returned as Query Assets API responses. To export the results to your own BigQuery table, specify a BigQuery destination in the request. If you don't already have one, you must create a BigQuery dataset before making these requests.
gcloud
Projects
gcloud asset query \
--project=PROJECT_ID \
--billing-project=BILLING_PROJECT_ID \
--statement="
SELECT
name, assetType
FROM
compute_googleapis_com_Instance
LIMIT 2" \
--bigquery-table=projects/PROJECT_ID/datasets/DATASET_ID/tables/TABLE_NAME \
--write-disposition="write-truncate"
Provide the following values:
PROJECT_ID
: The ID of the project whose metadata you want to query.BILLING_PROJECT_ID
: Optional. The project ID that the default Cloud Asset Inventory service agent is in that has permissions to write to BigQuery. Not required if you've already switched to the billing project withgcloud config set project
. Read more about billing projects.DATASET_ID
: The ID of the BigQuery dataset.TABLE_NAME
: The table you're exporting your metadata to. If it doesn't exist, it's created.
Other flags:
--write-disposition
: Specifies the action that occurs if the BigQuery destination table or partition already exists by setting the write disposition. The following values are supported:write-truncate
: If the table or partition already exists, BigQuery overwrites the entire table or all partitions data.write-append
: If the table or partition already exists, BigQuery appends the data to the table or the latest partition.write-empty
: If the table already exists and contains data, aduplicate
error is returned in the job result.
The default value is
write-empty
.
Folders
gcloud asset query \
--folder=FOLDER_ID \
--billing-project=BILLING_PROJECT_ID \
--statement="
SELECT
name, assetType
FROM
compute_googleapis_com_Instance
LIMIT 2" \
--bigquery-table=projects/PROJECT_ID/datasets/DATASET_ID/tables/TABLE_NAME \
--write-disposition="write-truncate"
Provide the following values:
FOLDER_ID
: The ID of the folder whose metadata you want to query.How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
BILLING_PROJECT_ID
: Optional. The project ID that the default Cloud Asset Inventory service agent is in that has permissions to write to BigQuery. Not required if you've already switched to the billing project withgcloud config set project
. Read more about billing projects.PROJECT_ID
: The ID of the project that the BigQuery table is in.DATASET_ID
: The ID of the BigQuery dataset.TABLE_NAME
: The table you're exporting your metadata to. If it doesn't exist, it's created.
Other flags:
--write-disposition
: Specifies the action that occurs if the BigQuery destination table or partition already exists by setting the write disposition. The following values are supported:write-truncate
: If the table or partition already exists, BigQuery overwrites the entire table or all partitions data.write-append
: If the table or partition already exists, BigQuery appends the data to the table or the latest partition.write-empty
: If the table already exists and contains data, aduplicate
error is returned in the job result.
The default value is
write-empty
.
Organizations
gcloud asset query \
--organization=ORGANIZATION_ID \
--billing-project=BILLING_PROJECT_ID \
--statement="
SELECT
name, assetType
FROM
compute_googleapis_com_Instance
LIMIT 2" \
--bigquery-table=projects/PROJECT_ID/datasets/DATASET_ID/tables/TABLE_NAME \
--write-disposition="write-truncate"
Provide the following values:
ORGANIZATION_ID
: The ID of the organization whose metadata you want to query.How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
BILLING_PROJECT_ID
: Optional. The project ID that the default Cloud Asset Inventory service agent is in that has permissions to write to BigQuery. Not required if you've already switched to the billing project withgcloud config set project
. Read more about billing projects.PROJECT_ID
: The ID of the project that the BigQuery table is in.DATASET_ID
: The ID of the BigQuery dataset.TABLE_NAME
: The table you're exporting your metadata to. If it doesn't exist, it's created.
Other flags:
--write-disposition
: Specifies the action that occurs if the BigQuery destination table or partition already exists by setting the write disposition. The following values are supported:write-truncate
: If the table or partition already exists, BigQuery overwrites the entire table or all partitions data.write-append
: If the table or partition already exists, BigQuery appends the data to the table or the latest partition.write-empty
: If the table already exists and contains data, aduplicate
error is returned in the job result.
The default value is
write-empty
.
Here's a sample response for a successful request that saves the query results to a specified BigQuery destination table:
done: true
jobReference: CiBqb2JfMkpzOERxN2l5RnRKeWJQRksxWUlmYkxWNTUzbhIBARixoYOcs9T_qcgB
outputConfig:
bigqueryDestination:
dataset: projects/test-project/datasets/my_dataset
table: my-table
writeDisposition: write-truncate
Here's a sample response for a job that failed to save the query results:
done: true
error:
code: 9
message: '1 errors encountered during query: notFound'
jobReference: CiBqb2JfZWlmOUNsVFQ3b05hVzhpYkdVZ291dkZXc1VFXxIBARj73sbsmLmE1BggAQ
REST
curl -X POST \
-H "X-Goog-User-Project: BILLING_PROJECT_ID" \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-d '{
"statement": "
SELECT
name, assetType
FROM
compute_googleapis_com_Instance
LIMIT 2",
"outputConfig": {
"bigqueryDestination": {
"dataset": "projects/PROJECT_ID/datasets/DATASET_ID",
"table": "TABLE_NAME",
"writeDisposition": "WRITE_TRUNCATE"
}
}
}' \
https://cloudasset.googleapis.com/v1/SCOPE:queryAssets
Provide the following values:
BILLING_PROJECT_ID
: The project ID that the default Cloud Asset Inventory service agent is in that has permissions to manage your BigQuery datasets and tables. Read more about billing projects.PROJECT_ID
: The ID of the project that the BigQuery table is in.DATASET_ID
: The ID of the BigQuery dataset.TABLE_NAME
: The table you're exporting your metadata to. If it doesn't exist, it's created.SCOPE
: A scope can be a project, a folder, or an organization.The allowed values are:
projects/PROJECT_ID
projects/PROJECT_NUMBER
How to find a Google Cloud project number
Console
To find a Google Cloud project number, complete the following steps:
-
Go to the Dashboard page in the Google Cloud console.
- Click the switcher box in the menu bar.
- Select your organization from the Select from box, and then search for your project name.
- Click the project name to switch to that project. The project number is shown in the Project info card.
gcloud CLI
You can retrieve a Google Cloud project number with the following command:
gcloud projects describe PROJECT_ID --format="value(projectNumber)"
-
folders/FOLDER_ID
How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
organizations/ORGANIZATION_ID
How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
Other parameters:
writeDisposition
: Specifies the action that occurs if the BigQuery destination table or partition already exists by setting the write disposition. The following values are supported:WRITE_TRUNCATE
: If the table or partition already exists, BigQuery overwrites the entire table or all partitions data.WRITE_APPEND
: If the table or partition already exists, BigQuery appends the data to the table or the latest partition.WRITE_EMPTY
: If the table already exists and contains data, aduplicate
error is returned in the job result.
The default value is
WRITE_EMPTY
.
Here's a sample response for a successful request that saves the query results to a specified BigQuery destination table:
{
"jobReference": "CiBqb2JfZmNlbTZ5SjVZcHFKajVIYjMycFNSd2xSRlZXdBIBARiAnb6R1I63wdkB",
"done": true,
"outputConfig": {
"bigqueryDestination": {
"dataset": "projects/test-project/datasets/my_dataset",
"table": "my-table",
"writeDisposition": "WRITE_TRUNCATE"
}
}
}
Here's a sample response for a job that failed to save the query results:
{
"jobReference": "CiBqb2JfZWlmOUNsVFQ3b05hVzhpYkdVZ291dkZXc1VFXxIBARj73sbsmLmE1BggAQ",
"done": true,
"error": {
"code": 9,
"message": "1 errors encountered during query: notFound"
}
}
The schema and rows are not returned in the query response directly. You can view them in the specified BigQuery destination table.
Sample queries
Query assets
The following examples query assets in a project, folder, or organization.
gcloud
Projects
gcloud asset query \
--project=PROJECT_ID \
--statement="
SELECT
name, assetType
FROM
compute_googleapis_com_Instance
LIMIT 2"
Provide the following values:
PROJECT_ID
: The ID of the project whose metadata you want to query.
Folders
gcloud asset query \
--folder=FOLDER_ID \
--statement="
SELECT
name, assetType
FROM
compute_googleapis_com_Instance
LIMIT 2"
Provide the following values:
FOLDER_ID
: The ID of the folder whose metadata you want to query.How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
Organizations
gcloud asset query \
--organization=ORGANIZATION_ID \
--statement="
SELECT
name, assetType
FROM
compute_googleapis_com_Instance
LIMIT 2"
Provide the following values:
ORGANIZATION_ID
: The ID of the organization whose metadata you want to query.How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
Here's a sample response for a successful request that returns all rows:
done: true
jobReference: CiBqb2JfMkpzOERxN2l5RnRKeWJQRksxWUlmYkxWNTUzbhIBARixoYOcs9T_qcgB
queryResult:
nextPageToken: ''
totalRows: '2'
name: //compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME
assetType: compute.googleapis.com/Instance
name: //compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME
assetType; compute.googleapis.com/Instance
REST
curl -X POST \
-H "X-Goog-User-Project: BILLING_PROJECT_ID" \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-d '{
"statement": "
SELECT
name, assetType
FROM
compute_googleapis_com_Instance
LIMIT 2" }' \
https://cloudasset.googleapis.com/v1/SCOPE:queryAssets
Provide the following values:
SCOPE
: A scope can be a project, a folder, or an organization.The allowed values are:
projects/PROJECT_ID
projects/PROJECT_NUMBER
How to find a Google Cloud project number
Console
To find a Google Cloud project number, complete the following steps:
-
Go to the Dashboard page in the Google Cloud console.
- Click the switcher box in the menu bar.
- Select your organization from the Select from box, and then search for your project name.
- Click the project name to switch to that project. The project number is shown in the Project info card.
gcloud CLI
You can retrieve a Google Cloud project number with the following command:
gcloud projects describe PROJECT_ID --format="value(projectNumber)"
-
folders/FOLDER_ID
How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
organizations/ORGANIZATION_ID
How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
Here's a sample response for a successful request that returns all rows:
{
"jobReference": "CiBqb2JfZmNlbTZ5SjVZcHFKajVIYjMycFNSd2xSRlZXdBIBARiAnb6R1I63wdkB",
"done": true,
"queryResult": {
"rows": [...],
"schema": {...},
"nextPageToken": "",
"totalRows": "2"
}
}
The schema and rows have been removed for readability. You can view them in Field Value Response format.
Query resource standard metadata across resource types
The following example queries the resource
standard metadata field name
and assetType
across all resource types in a
specific region.
gcloud
Projects
gcloud asset query \
--project=PROJECT_ID \
--statement="
SELECT
name,
assetType
FROM
STANDARD_METADATA
WHERE
resource.location LIKE '%asia%'"
Provide the following values:
PROJECT_ID
: The ID of the project whose metadata you want to query.
Folders
gcloud asset query \
--folder=FOLDER_ID \
--statement="
SELECT
name,
assetType
FROM
STANDARD_METADATA
WHERE
resource.location LIKE '%asia%'"
Provide the following values:
FOLDER_ID
: The ID of the folder whose metadata you want to query.How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
Organizations
gcloud asset query \
--organization=ORGANIZATION_ID \
--statement="
SELECT
name,
assetType
FROM
STANDARD_METADATA
WHERE
resource.location LIKE '%asia%'"
Provide the following values:
ORGANIZATION_ID
: The ID of the organization whose metadata you want to query.How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
REST
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-d '{
"statement": "
SELECT
name,
assetType
FROM
STANDARD_METADATA
WHERE
resource.location LIKE \"%asia%\""
}' \
https://cloudasset.googleapis.com/v1/SCOPE:queryAssets
Provide the following values:
SCOPE
: A scope can be a project, a folder, or an organization.The allowed values are:
projects/PROJECT_ID
projects/PROJECT_NUMBER
How to find a Google Cloud project number
Console
To find a Google Cloud project number, complete the following steps:
-
Go to the Dashboard page in the Google Cloud console.
- Click the switcher box in the menu bar.
- Select your organization from the Select from box, and then search for your project name.
- Click the project name to switch to that project. The project number is shown in the Project info card.
gcloud CLI
You can retrieve a Google Cloud project number with the following command:
gcloud projects describe PROJECT_ID --format="value(projectNumber)"
-
folders/FOLDER_ID
How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
organizations/ORGANIZATION_ID
How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
Fetching a response asynchronously by job reference
Run the following command which times out.
gcloud
Projects
gcloud asset query \
--project=PROJECT_ID \
--timeout="1s" \
--statement="
SELECT
name, assetType
FROM
compute_googleapis_com_Instance";
Provide the following values:
PROJECT_ID
: The ID of the project whose metadata you want to query.
When a request doesn't complete in time, its done
field is set to
false
, which means the request didn't finish in time but is being
processed. The following sample shows a response that indicates that the
request isn't done processing.
done: false
job_reference: "JOB_REFERENCE_ID"
You can use this job reference ID to get the result asynchronously later with another API call:
gcloud asset query \
--project=PROJECT_ID \
--job-reference=JOB_REFERENCE_ID
Folders
gcloud asset query \
--folder=FOLDER_ID \
--timeout="1s" \
--statement="
SELECT
name, assetType
FROM
compute_googleapis_com_Instance";
Provide the following values:
FOLDER_ID
: The ID of the folder whose metadata you want to query.How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
When a request doesn't complete in time, its done
field is set to
false
, which means the request didn't finish in time but is being
processed. The following sample shows a response that indicates that the
request isn't done processing.
done: false
job_reference: "JOB_REFERENCE_ID"
You can use this job reference ID to get the result asynchronously later with another API call:
gcloud asset query \
--folder=FOLDER_ID \
--job-reference=JOB_REFERENCE_ID
Organizations
gcloud asset query \
--organization=ORGANIZATION_ID \
--timeout="1s" \
--statement="
SELECT
name, assetType
FROM
compute_googleapis_com_Instance";
Provide the following values:
ORGANIZATION_ID
: The ID of the organization whose metadata you want to query.How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
When a request doesn't complete in time, its done
field is set to
false
, which means the request didn't finish in time but is being
processed. The following sample shows a response that indicates that the
request isn't done processing.
done: false
job_reference: "JOB_REFERENCE_ID"
You can use this job reference ID to get the result asynchronously later with another API call:
gcloud asset query \
--organization=ORGANIZATION_ID \
--job-reference=JOB_REFERENCE_ID
REST
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-d '{
"timeout": "1s",
"statement": "
SELECT
name, assetType
FROM
compute_googleapis_com_Instance"
}' \
https://cloudasset.googleapis.com/v1/SCOPE:queryAssets
Provide the following values:
SCOPE
: A scope can be a project, a folder, or an organization.The allowed values are:
projects/PROJECT_ID
projects/PROJECT_NUMBER
How to find a Google Cloud project number
Console
To find a Google Cloud project number, complete the following steps:
-
Go to the Dashboard page in the Google Cloud console.
- Click the switcher box in the menu bar.
- Select your organization from the Select from box, and then search for your project name.
- Click the project name to switch to that project. The project number is shown in the Project info card.
gcloud CLI
You can retrieve a Google Cloud project number with the following command:
gcloud projects describe PROJECT_ID --format="value(projectNumber)"
-
folders/FOLDER_ID
How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
organizations/ORGANIZATION_ID
How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
When a request doesn't complete in time, its done
field is set to false
,
which means the request didn't finish in time but is being processed. The
following sample shows a response that indicates that the request isn't done
processing.
{
"jobReference": "JOB_REFERENCE_ID",
"done": false,
"queryResult": {
"rows": [],
"schema": {
"fields": []
},
"nextPageToken": "",
"totalRows": "0"
}
}
You can use this job reference ID to get the result asynchronously later with another API call:
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-d '{
"jobReference": "JOB_REFERENCE_ID"
}' \
https://cloudasset.googleapis.com/v1/SCOPE:queryAssets
Fetching the next page of results for paginated requests with the REST API
Make the following query, which sets a pageSize
of 1
:
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-d '{
"pageSize": "1",
"statement": "
SELECT
name, assetType
FROM
compute_googleapis_com_Instance"
}' \
https://cloudasset.googleapis.com/v1/SCOPE:queryAssets
Provide the following values:
SCOPE
: A scope can be a project, a folder, or an organization.The allowed values are:
projects/PROJECT_ID
projects/PROJECT_NUMBER
How to find a Google Cloud project number
Console
To find a Google Cloud project number, complete the following steps:
-
Go to the Dashboard page in the Google Cloud console.
- Click the switcher box in the menu bar.
- Select your organization from the Select from box, and then search for your project name.
- Click the project name to switch to that project. The project number is shown in the Project info card.
gcloud CLI
You can retrieve a Google Cloud project number with the following command:
gcloud projects describe PROJECT_ID --format="value(projectNumber)"
-
folders/FOLDER_ID
How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
organizations/ORGANIZATION_ID
How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
Other parameters:
pageSize
: The maximum number of resources to show per page.
The response has a nextPageToken
that can be set in a request with
jobReference
to get the next page of responses.
{
"jobReference": "JOB_REFERENCE_ID",
"done": true,
"queryResult": {
"rows": [ ... ],
"schema": { ... },
"nextPageToken": "NEXT_PAGE_TOKEN",
"totalRows": "11"
}
}
The schema and rows have been removed for readability. You can view them in Field Value Response format.
You can get the next page of results by referencing the page token:
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-d '{
"jobReference": "JOB_REFERENCE_ID",
"pageToken": "NEXT_PAGE_TOKEN"
}' \
https://cloudasset.googleapis.com/v1/SCOPE:queryAssets
Query how many VMs are in each region
gcloud
Projects
gcloud asset query \
--project=PROJECT_ID \
--statement="
SELECT
resource.location,
COUNT(*)
FROM
compute_googleapis_com_Instance
GROUP BY
resource.location"
Provide the following values:
PROJECT_ID
: The ID of the project whose metadata you want to query.
Folders
gcloud asset query \
--folder=FOLDER_ID \
--statement="
SELECT
resource.location,
COUNT(*)
FROM
compute_googleapis_com_Instance
GROUP BY
resource.location"
Provide the following values:
FOLDER_ID
: The ID of the folder whose metadata you want to query.How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
Organizations
gcloud asset query \
--organization=ORGANIZATION_ID \
--statement="
SELECT
resource.location,
COUNT(*)
FROM
compute_googleapis_com_Instance
GROUP BY
resource.location"
Provide the following values:
ORGANIZATION_ID
: The ID of the organization whose metadata you want to query.How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
REST
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-d '{
"statement": "
SELECT
resource.location,
COUNT(*)
FROM
compute_googleapis_com_Instance
GROUP BY
resource.location"
}' \
https://cloudasset.googleapis.com/v1/SCOPE:queryAssets
Provide the following values:
SCOPE
: A scope can be a project, a folder, or an organization.The allowed values are:
projects/PROJECT_ID
projects/PROJECT_NUMBER
How to find a Google Cloud project number
Console
To find a Google Cloud project number, complete the following steps:
-
Go to the Dashboard page in the Google Cloud console.
- Click the switcher box in the menu bar.
- Select your organization from the Select from box, and then search for your project name.
- Click the project name to switch to that project. The project number is shown in the Project info card.
gcloud CLI
You can retrieve a Google Cloud project number with the following command:
gcloud projects describe PROJECT_ID --format="value(projectNumber)"
-
folders/FOLDER_ID
How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
organizations/ORGANIZATION_ID
How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
Query to identify the VMs in a specific region
gcloud
Projects
gcloud asset query \
--project=PROJECT_ID \
--statement="
SELECT
name,
resource.DATA.creationTimestamp
FROM
compute_googleapis_com_Instance
WHERE
resource.location LIKE '%asia%'"
Provide the following values:
PROJECT_ID
: The ID of the project whose metadata you want to query.
Folders
gcloud asset query \
--folder=FOLDER_ID \
--statement="
SELECT
name,
resource.DATA.creationTimestamp
FROM
compute_googleapis_com_Instance
WHERE
resource.location LIKE '%asia%'"
Provide the following values:
FOLDER_ID
: The ID of the folder whose metadata you want to query.How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
Organizations
gcloud asset query \
--organization=ORGANIZATION_ID \
--statement="
SELECT
name,
resource.DATA.creationTimestamp
FROM
compute_googleapis_com_Instance
WHERE
resource.location LIKE '%asia%'"
Provide the following values:
ORGANIZATION_ID
: The ID of the organization whose metadata you want to query.How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
REST
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-d '{
"statement": "
SELECT
name,
resource.DATA.creationTimestamp
FROM
compute_googleapis_com_Instance
WHERE
resource.location LIKE \"%asia%\""
}' \
https://cloudasset.googleapis.com/v1/SCOPE:queryAssets
Provide the following values:
SCOPE
: A scope can be a project, a folder, or an organization.The allowed values are:
projects/PROJECT_ID
projects/PROJECT_NUMBER
How to find a Google Cloud project number
Console
To find a Google Cloud project number, complete the following steps:
-
Go to the Dashboard page in the Google Cloud console.
- Click the switcher box in the menu bar.
- Select your organization from the Select from box, and then search for your project name.
- Click the project name to switch to that project. The project number is shown in the Project info card.
gcloud CLI
You can retrieve a Google Cloud project number with the following command:
gcloud projects describe PROJECT_ID --format="value(projectNumber)"
-
folders/FOLDER_ID
How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
organizations/ORGANIZATION_ID
How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
Query to identify every publicly accessible Cloud Storage bucket
gcloud
Projects
gcloud asset query \
--project=PROJECT_ID \
--statement="
SELECT
name
FROM
IAM_POLICY
CROSS JOIN
UNNEST(iamPolicy.bindings) AS binding
WHERE
('allUsers' IN UNNEST(binding.members)
OR 'allAuthenticatedUsers' IN UNNEST(binding.members))
AND assetType = 'storage.googleapis.com/Bucket'"
Provide the following values:
PROJECT_ID
: The ID of the project whose metadata you want to query.
Folders
gcloud asset query \
--folder=FOLDER_ID \
--statement="
SELECT
name
FROM
IAM_POLICY
CROSS JOIN
UNNEST(iamPolicy.bindings) AS binding
WHERE
('allUsers' IN UNNEST(binding.members)
OR 'allAuthenticatedUsers' IN UNNEST(binding.members))
AND assetType = 'storage.googleapis.com/Bucket'"
Provide the following values:
FOLDER_ID
: The ID of the folder whose metadata you want to query.How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
Organizations
gcloud asset query \
--organization=ORGANIZATION_ID \
--statement="
SELECT
name
FROM
IAM_POLICY
CROSS JOIN
UNNEST(iamPolicy.bindings) AS binding
WHERE
('allUsers' IN UNNEST(binding.members)
OR 'allAuthenticatedUsers' IN UNNEST(binding.members))
AND assetType = 'storage.googleapis.com/Bucket'"
Provide the following values:
ORGANIZATION_ID
: The ID of the organization whose metadata you want to query.How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
REST
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-d '{
"statement": "
SELECT
name
FROM
IAM_POLICY
CROSS JOIN
UNNEST(iamPolicy.bindings) AS binding
WHERE
(\"allUsers\" IN UNNEST(binding.members)
OR \"allAuthenticatedUsers\" IN UNNEST(binding.members))
AND assetType = \"storage.googleapis.com/Bucket\""
}' \
https://cloudasset.googleapis.com/v1/SCOPE:queryAssets
Provide the following values:
SCOPE
: A scope can be a project, a folder, or an organization.The allowed values are:
projects/PROJECT_ID
projects/PROJECT_NUMBER
How to find a Google Cloud project number
Console
To find a Google Cloud project number, complete the following steps:
-
Go to the Dashboard page in the Google Cloud console.
- Click the switcher box in the menu bar.
- Select your organization from the Select from box, and then search for your project name.
- Click the project name to switch to that project. The project number is shown in the Project info card.
gcloud CLI
You can retrieve a Google Cloud project number with the following command:
gcloud projects describe PROJECT_ID --format="value(projectNumber)"
-
folders/FOLDER_ID
How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
organizations/ORGANIZATION_ID
How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
Query to find subnetworks that don't have attached VMs
gcloud
Projects
gcloud asset query \
--project=PROJECT_ID \
--statement="
SELECT
subnetwork_table.name
FROM
compute_googleapis_com_Subnetwork AS subnetwork_table
LEFT JOIN (
SELECT
interface.subnetwork AS subnetwork
FROM
compute_googleapis_com_Instance
CROSS JOIN
UNNEST(resource.DATA.networkInterfaces) AS interface) AS instance_table
ON
SUBSTR(subnetwork_table.name, 25) = SUBSTR(instance_table.subnetwork,38)
WHERE
instance_table.subnetwork IS NULL
AND NOT subnetwork_table.name LIKE '%default%'"
Provide the following values:
PROJECT_ID
: The ID of the project whose metadata you want to query.
Folders
gcloud asset query \
--folder=FOLDER_ID \
--statement="
SELECT
subnetwork_table.name
FROM
compute_googleapis_com_Subnetwork AS subnetwork_table
LEFT JOIN (
SELECT
interface.subnetwork AS subnetwork
FROM
compute_googleapis_com_Instance
CROSS JOIN
UNNEST(resource.DATA.networkInterfaces) AS interface) AS instance_table
ON
SUBSTR(subnetwork_table.name, 25) = SUBSTR(instance_table.subnetwork,38)
WHERE
instance_table.subnetwork IS NULL
AND NOT subnetwork_table.name LIKE '%default%'"
Provide the following values:
FOLDER_ID
: The ID of the folder whose metadata you want to query.How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
Organizations
gcloud asset query \
--organization=ORGANIZATION_ID \
--statement="
SELECT
subnetwork_table.name
FROM
compute_googleapis_com_Subnetwork AS subnetwork_table
LEFT JOIN (
SELECT
interface.subnetwork AS subnetwork
FROM
compute_googleapis_com_Instance
CROSS JOIN
UNNEST(resource.DATA.networkInterfaces) AS interface) AS instance_table
ON
SUBSTR(subnetwork_table.name, 25) = SUBSTR(instance_table.subnetwork,38)
WHERE
instance_table.subnetwork IS NULL
AND NOT subnetwork_table.name LIKE '%default%'"
Provide the following values:
ORGANIZATION_ID
: The ID of the organization whose metadata you want to query.How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
REST
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-d '{
"statement": "
SELECT
subnetwork_table.name
FROM
compute_googleapis_com_Subnetwork AS subnetwork_table
LEFT JOIN (
SELECT
interface.subnetwork AS subnetwork
FROM
compute_googleapis_com_Instance
CROSS JOIN
UNNEST(resource.DATA.networkInterfaces) AS interface) AS instance_table
ON
SUBSTR(subnetwork_table.name, 25) = SUBSTR(instance_table.subnetwork,38)
WHERE
instance_table.subnetwork IS NULL
AND NOT subnetwork_table.name LIKE \"%default%\""
}' \
https://cloudasset.googleapis.com/v1/SCOPE:queryAssets
Provide the following values:
SCOPE
: A scope can be a project, a folder, or an organization.The allowed values are:
projects/PROJECT_ID
projects/PROJECT_NUMBER
How to find a Google Cloud project number
Console
To find a Google Cloud project number, complete the following steps:
-
Go to the Dashboard page in the Google Cloud console.
- Click the switcher box in the menu bar.
- Select your organization from the Select from box, and then search for your project name.
- Click the project name to switch to that project. The project number is shown in the Project info card.
gcloud CLI
You can retrieve a Google Cloud project number with the following command:
gcloud projects describe PROJECT_ID --format="value(projectNumber)"
-
folders/FOLDER_ID
How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
organizations/ORGANIZATION_ID
How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
Query to find the number of BigQuery datasets in each project
gcloud
Projects
gcloud asset query \
--project=PROJECT_ID \
--statement="
SELECT
ancestor AS project,
COUNT(*)
FROM
bigquery_googleapis_com_Dataset
CROSS JOIN
UNNEST (ancestors) AS ancestor
WHERE
ancestor LIKE '%project%'
GROUP BY
ancestor
ORDER BY
2 DESC"
Provide the following values:
PROJECT_ID
: The ID of the project whose metadata you want to query.
Folders
gcloud asset query \
--folder=FOLDER_ID \
--statement="
SELECT
ancestor AS project,
COUNT(*)
FROM
bigquery_googleapis_com_Dataset
CROSS JOIN
UNNEST (ancestors) AS ancestor
WHERE
ancestor LIKE '%project%'
GROUP BY
ancestor
ORDER BY
2 DESC"
Provide the following values:
FOLDER_ID
: The ID of the folder whose metadata you want to query.How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
Organizations
gcloud asset query \
--organization=ORGANIZATION_ID \
--statement="
SELECT
ancestor AS project,
COUNT(*)
FROM
bigquery_googleapis_com_Dataset
CROSS JOIN
UNNEST (ancestors) AS ancestor
WHERE
ancestor LIKE '%project%'
GROUP BY
ancestor
ORDER BY
2 DESC"
Provide the following values:
ORGANIZATION_ID
: The ID of the organization whose metadata you want to query.How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
REST
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-d '{
"statement": "
SELECT
ancestor AS project,
COUNT(*)
FROM
bigquery_googleapis_com_Dataset
CROSS JOIN
UNNEST (ancestors) AS ancestor
WHERE
ancestor LIKE \"%project%\"
GROUP BY
ancestor
ORDER BY
2 DESC"
}' \
https://cloudasset.googleapis.com/v1/SCOPE:queryAssets
Provide the following values:
SCOPE
: A scope can be a project, a folder, or an organization.The allowed values are:
projects/PROJECT_ID
projects/PROJECT_NUMBER
How to find a Google Cloud project number
Console
To find a Google Cloud project number, complete the following steps:
-
Go to the Dashboard page in the Google Cloud console.
- Click the switcher box in the menu bar.
- Select your organization from the Select from box, and then search for your project name.
- Click the project name to switch to that project. The project number is shown in the Project info card.
gcloud CLI
You can retrieve a Google Cloud project number with the following command:
gcloud projects describe PROJECT_ID --format="value(projectNumber)"
-
folders/FOLDER_ID
How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
organizations/ORGANIZATION_ID
How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
Query to identify the VMs in a specific region at a specific timestamp
gcloud
Projects
gcloud asset query \
--project=PROJECT_ID \
--snapshot-time="SNAPSHOT_TIME" \
--statement="
SELECT
name,
resource.DATA.creationTimestamp
FROM
compute_googleapis_com_Instance
WHERE
resource.location LIKE '%asia%'"
Provide the following values:
PROJECT_ID
: The ID of the project whose metadata you want to query.SNAPSHOT_TIME
: Optional. The time at which you want to take a snapshot of your assets. The value must be the current time or a time no more than 35 days in the past. When not provided, a snapshot is taken at the current time. For information on time formats, see gcloud topic datetimes.
Folders
gcloud asset query \
--folder=FOLDER_ID \
--snapshot-time="SNAPSHOT_TIME" \
--statement="
SELECT
name,
resource.DATA.creationTimestamp
FROM
compute_googleapis_com_Instance
WHERE
resource.location LIKE '%asia%'"
Provide the following values:
FOLDER_ID
: The ID of the folder whose metadata you want to query.How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
SNAPSHOT_TIME
: Optional. The time at which you want to take a snapshot of your assets. The value must be the current time or a time no more than 35 days in the past. When not provided, a snapshot is taken at the current time. For information on time formats, see gcloud topic datetimes.
Organizations
gcloud asset query \
--organization=ORGANIZATION_ID \
--snapshot-time="SNAPSHOT_TIME" \
--statement="
SELECT
name,
resource.DATA.creationTimestamp
FROM
compute_googleapis_com_Instance
WHERE
resource.location LIKE '%asia%'"
Provide the following values:
ORGANIZATION_ID
: The ID of the organization whose metadata you want to query.How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
SNAPSHOT_TIME
: Optional. The time at which you want to take a snapshot of your assets. The value must be the current time or a time no more than 35 days in the past. When not provided, a snapshot is taken at the current time. For information on time formats, see gcloud topic datetimes.
REST
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-d '{
"statement": "
SELECT
name,
resource.DATA.creationTimestamp
FROM
compute_googleapis_com_Instance
WHERE
resource.location LIKE \"%asia%\"",
"readTime": "SNAPSHOT_TIME"
}' \
https://cloudasset.googleapis.com/v1/SCOPE:queryAssets
Provide the following values:
SNAPSHOT_TIME
: Optional. The time at which you want to take a snapshot of your assets, in RFC 3339 format. The value must be the current time or a time no more than 35 days in the past. When not provided, a snapshot is taken at the current time.SCOPE
: A scope can be a project, a folder, or an organization.The allowed values are:
projects/PROJECT_ID
projects/PROJECT_NUMBER
How to find a Google Cloud project number
Console
To find a Google Cloud project number, complete the following steps:
-
Go to the Dashboard page in the Google Cloud console.
- Click the switcher box in the menu bar.
- Select your organization from the Select from box, and then search for your project name.
- Click the project name to switch to that project. The project number is shown in the Project info card.
gcloud CLI
You can retrieve a Google Cloud project number with the following command:
gcloud projects describe PROJECT_ID --format="value(projectNumber)"
-
folders/FOLDER_ID
How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
organizations/ORGANIZATION_ID
How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
Query to identify the change history of VMs in a specific time range
gcloud
Projects
gcloud asset query \
--project=PROJECT_ID \
--start-time="START_TIME" \
--end-time="END_TIME" \
--statement="
SELECT
name,
resource.DATA.creationTimestamp
FROM
compute_googleapis_com_Instance"
Provide the following values:
PROJECT_ID
: The ID of the project whose assets you want to list.START_TIME
: Optional. The beginning of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. For information on time formats, see gcloud topic datetimes.END_TIME
: Optional. The finishing point of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. When not provided, the end time is assumed to be the current time. For information on time formats, see gcloud topic datetimes.
Folders
gcloud asset query \
--folder=FOLDER_ID \
--start-time="START_TIME" \
--end-time="END_TIME" \
--statement="
SELECT
name,
resource.DATA.creationTimestamp
FROM
compute_googleapis_com_Instance"
Provide the following values:
FOLDER_ID
: The ID of the folder whose assets you want to list.How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
START_TIME
: Optional. The beginning of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. For information on time formats, see gcloud topic datetimes.END_TIME
: Optional. The finishing point of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. When not provided, the end time is assumed to be the current time. For information on time formats, see gcloud topic datetimes.
Organizations
gcloud asset query \
--organization=ORGANIZATION_ID \
--start-time="START_TIME" \
--end-time="END_TIME" \
--statement="
SELECT
name,
resource.DATA.creationTimestamp
FROM
compute_googleapis_com_Instance"
Provide the following values:
ORGANIZATION_ID
: The ID of the organization whose assets you want to list.How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-
START_TIME
: Optional. The beginning of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. For information on time formats, see gcloud topic datetimes.END_TIME
: Optional. The finishing point of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. When not provided, the end time is assumed to be the current time. For information on time formats, see gcloud topic datetimes.
REST
curl -X POST \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
-d '{
"statement": "
SELECT
name,
resource.DATA.creationTimestamp
FROM
compute_googleapis_com_Instance",
"readTimeWindow": {
"startTime": "START_TIME",
"endTime": "END_TIME"
}
}' \
https://cloudasset.googleapis.com/v1/SCOPE:queryAssets
Provide the following values:
START_TIME
: Optional. The beginning of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. For information on time formats, see gcloud topic datetimes.END_TIME
: Optional. The finishing point of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. When not provided, the end time is assumed to be the current time. For information on time formats, see gcloud topic datetimes.SCOPE
: A scope can be a project, a folder, or an organization.The allowed values are:
projects/PROJECT_ID
projects/PROJECT_NUMBER
How to find a Google Cloud project number
Console
To find a Google Cloud project number, complete the following steps:
-
Go to the Dashboard page in the Google Cloud console.
- Click the switcher box in the menu bar.
- Select your organization from the Select from box, and then search for your project name.
- Click the project name to switch to that project. The project number is shown in the Project info card.
gcloud CLI
You can retrieve a Google Cloud project number with the following command:
gcloud projects describe PROJECT_ID --format="value(projectNumber)"
-
folders/FOLDER_ID
How to find a Google Cloud folder ID
Console
To find a Google Cloud folder ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI
You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the
--format
option to see further information about the found folders.To get the ID of a folder within another folder, list the subfolders:
gcloud resource-manager folders list --folder=FOLDER_ID
-
organizations/ORGANIZATION_ID
How to find a Google Cloud organization ID
Console
To find a Google Cloud organization ID, complete the following steps:
-
Go to the Google Cloud console.
- Click the switcher box in the menu bar.
- Click the Select from box, and then select your organization.
- Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI
You can retrieve a Google Cloud organization ID with the following command:
gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
-