Cloud 애셋 인벤토리는 온보딩된 리소스와 연결된 애셋 메타데이터를 검색, 내보내기, 분석할 수 있는 시계열 데이터베이스를 기반으로 인벤토리 서비스를 제공합니다. Cloud 애셋 인벤토리는 각 리소스 및 정책 유형 수준에 이르기까지 Cloud 애셋 인벤토리 데이터에 대한 액세스를 제어할 수 있는 완전 관리형 인벤토리 서비스입니다. 이 서비스를 통해 중앙 집중식 인벤토리의 이점을 활용하고 필요한 경우 최소 권한도 얻을 수 있습니다.
주요 VMware Engine 리소스 또는 애셋은 Cloud Asset API를 통해 제공되며 Google Cloud 콘솔에서 Identity and Access Management 아래의 Cloud 애셋 인벤토리 UI를 통해 사용할 수도 있습니다. Cloud Asset API 리소스에는 다음이 포함됩니다.
QueryAssets: BigQuery SQL과 호환되는 SQL 문을 사용하여 애셋을 쿼리하는 작업을 실행합니다.
또한 이러한 API를 사용하면 Google Cloud 콘솔에서 전체 검색을 사용하여 VMware Engine 리소스를 찾을 수 있습니다. 전역 검색창을 사용하여 Cloud Asset API를 통해 제공되는 VMware Engine 리소스의 이름을 검색하세요. 리소스가 결과 목록에 표시됩니다.
Cloud 애셋 인벤토리 콘솔을 사용하여 VMware Engine 리소스 또는 IAM 정책을 검색하려면 다음을 수행합니다.
커스텀 쿼리 창에서 분석 > 쿼리 실행을 클릭합니다. 보고서 페이지에는 입력한 쿼리 매개변수와 지정된 리소스에 대한 지정된 역할 또는 권한이 있는 모든 주 구성원의 결과 표가 표시됩니다.
Google Cloud 콘솔의 정책 분석 쿼리는 최대 1분 동안 실행됩니다. 1분 후에 Google Cloud 콘솔에서 쿼리를 중지하고 사용 가능한 모든 결과를 표시합니다. 쿼리가 해당 시간 내에 완료되지 않은 경우 Google Cloud Console에 결과가 불완전하다는 배너가 표시됩니다. 이러한 쿼리에 대한 결과를 더 가져오려면 BigQuery로 결과를 내보냅니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-21(UTC)"],[],[],null,["# Asset inventory services for VMware Engine\n==========================================\n\nCloud Asset Inventory provides inventory services based on a time series database that\nenables you to search, export, and analyze asset metadata associated with the\nonboarded resources. Cloud Asset Inventory is a fully managed inventory service\nwhere you can control the access to Cloud Asset Inventory data down to each\nresource and policy type. This lets you benefit from the power of a centralized\ninventory, and also achieve least privilege when needed.\n\nKey VMware Engine resources or assets are available through the\nCloud Asset API and are also available using the Cloud Asset Inventory UI under\nIdentity and Access Management on your Google Cloud console. The Cloud Asset API resources include:\n\n- [PrivateCloud](/vmware-engine/docs/reference/rest/v1/projects.locations.privateClouds)\n- [Cluster](/vmware-engine/docs/reference/rest/v1/projects.locations.privateClouds.clusters)\n- [VMwareEngineNetwork](/vmware-engine/docs/reference/rest/v1/projects.locations.vmwareEngineNetworks)\n- [NetworkPeering](/vmware-engine/docs/reference/rest/v1/projects.locations.networkPeerings)\n- [PrivateConnection](/vmware-engine/docs/reference/rest/v1/projects.locations.privateConnections)\n- [NetworkPolicy](/vmware-engine/docs/reference/rest/v1/projects.locations.networkPolicies)\n- [ExternalAccessRule](/vmware-engine/docs/reference/rest/v1/projects.locations.networkPolicies.externalAccessRules)\n- [ExternalAddress](/vmware-engine/docs/reference/rest/v1/projects.locations.privateClouds.externalAddresses)\n\nFor these resources, the Cloud Asset Inventory UI and Cloud Asset API enable the\nfollowing features:\n\n- **Search and visibility:** Search asset metadata, including\n IAM policies associated with it by using a custom query\n language.\n\n - [SearchAllResources](/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllResources): Searches all Google Cloud resources within the specified scope, such as project, folder, or organization.\n - [SearchAllIamPolicies](/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllIamPolicies): Searches all IAM policies within the specified scope, such as project, folder, or organization.\n - [ListAssets](/asset-inventory/docs/listing-assets): View a paginated list of the assets at a given timestamp.\n - [QueryAssets](/asset-inventory/docs/reference/rest/v1/TopLevel/queryAssets): Issue a job that queries assets using an SQL statement compatible with BigQuery SQL.\n - These API also enable you to use the Global Search on the Google Cloud console to find VMware Engine resources. Use the global search bar to search for the name of any VMware Engine resource that's available through the Cloud Asset API. The resource displays in the list of results.\n\n To search VMware Engine resources or IAM policies\n using the Cloud Asset Inventory console, do the following:\n 1. Go to the **Asset Inventory** page in the Google Cloud console.\n\n [Go to Asset Inventory](https://console.cloud.google.com/iam-admin/asset-inventory/policies)\n 1. To set the scope of your search, open the Projects list box in the menu\n bar, and then select the organization, folder, or project to query.\n\n 2. Select the **Resource** or **IAM Policy** tab.\n\n 3. For **Filter results**, check the box next to the chosen filters.\n\n The resources or policies matching the query are listed in the **Result**\n table.\n\n To view the query as a Google Cloud CLI command, select **View query**.\n\n To export the results, select **Download CSV**.\n- **Monitoring and analysis:** You can export all asset metadata at a certain\n timestamp or export event change history during a specific timeframe.\n Further, you can also monitor asset changes by subscribing to real-time\n notifications.\n\n - [ExportAssets](/asset-inventory/docs/reference/rest/v1/TopLevel/exportAssets): Exports assets with time and resource types to a given Cloud Storage location or BigQuery table.\n - [BatchGetAssetsHistory](/asset-inventory/docs/reference/rest/v1/TopLevel/batchGetAssetsHistory): Batch gets the update history of assets that overlap a time window.\n - [Feed](/asset-inventory/docs/reference/rest/v1/feeds): An asset feed used to export asset updates to a destination. Set up Cloud Pub/Sub channels to get real-time updates on any asset config change, reduce the frequency of exports, and easily achieve continuous monitoring.\n\n To analyze which IAM policies have access to which\n Google Cloud resources using the Cloud Asset Inventory console, do the\n following:\n 1. In the Google Cloud console, go to the **Policy Analyzer**\n page.\n\n [Go to the Policy Analyzer page](https://console.cloud.google.com/iam-admin/analyzer)\n 2. In the **Analyze policies** section, find the pane labeled **Custom\n query** and click **Create custom query** in that pane.\n\n 3. In the **Select query scope** field, select the project, folder, or\n organization that you want to scope the query to.\n Policy Analyzer will analyze access for that project, folder,\n or organization, as well as any resources within that project, folder,\n or organization.\n\n 4. Choose the resource to check and the role or permission to check for:\n\n 1. In the **Parameter 1** field, select **Resource** from the drop-down menu.\n 2. In the **Resource** field, enter the full resource name of the resource that you want to analyze access for. If you don't know the full resource name, start typing the display name of the resource, then select the resource from the list of resources provided.\n 3. Click add **Add selector**.\n 4. In the **Parameter 2** field, select either **Role** or **Permission**.\n 5. In the **Select a role** or **Select a permission** field, select the role or permission that you want to check for.\n 6. Optional: To check for additional roles and permissions, continue adding **Role** and **Permission** selectors until all the roles and permissions that you want to check for are listed.\n 5. Optional: Click **Continue** , then select any\n [advanced options](/policy-intelligence/docs/analyze-iam-policies#options) that you want to enable for this query.\n\n 6. In the **Custom query** pane, click **Analyze \\\u003e Run\n query**. The report page shows the query parameters you entered, and a\n results table of all principals with the specified roles or permissions\n on the specified resource.\n\n\n Policy analysis queries in the Google Cloud console run for up to one minute. After\n one minute, the Google Cloud console stops the query and displays all available\n results. If the query didn't finish in that time, the Google Cloud console displays\n a banner indicating that the results are incomplete. To get more results\n for these queries,\n [export the\n results to BigQuery](/policy-intelligence/docs/policy-analyzer-write-to-bigquery).\n- **IAM policy analysis:** [Analyze policy APIs](/asset-inventory/docs/analyzing-iam-policy) to find\n out who has access to what.\n\n - [AnalyzeIamPolicy](/asset-inventory/docs/reference/rest/v1/TopLevel/analyzeIamPolicy): Analyzes IAM policies to answer which identities have what accesses on which resources.\n - [AnalyzeIamPolicyLongrunning](/asset-inventory/docs/reference/rest/v1/TopLevel/analyzeIamPolicyLongrunning): Analyzes IAM policies asynchronously to answer which identities have what accesses on which resources, and writes the analysis results to a Cloud Storage or a BigQuery destination.\n\nWhat's next\n-----------\n\n- Find the list of [resources available using Cloud Asset Inventory](/asset-inventory/docs/supported-asset-types) and search for VMware.\n- Learn more about what you can do with [Cloud Asset Inventory](/asset-inventory/docs/overview)."]]
