Back to Checks
gcp

Project has Cloud Asset Inventory API enabled

iam_cloud_asset_inventory_enabled
Service: iamSeverity: high
OfficialBuilt-inVerified
Categories:forensics-ready
Resource Type:serviceusage.googleapis.com/Service

Project service usage includes the Cloud Asset Inventory API (cloudasset.googleapis.com), enabling resource and IAM policy inventory with time-series metadata and change history.

Prowler logoProwlerprowler-provider-gcp

Risk

Without Cloud Asset Inventory, gaps in asset and IAM visibility hinder detection of drift and unauthorized changes, weakening access control integrity and risking data confidentiality. Shadow assets and silent privilege escalation can persist, delaying incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks iam_cloud_asset_inventory_enabled

Recommendation

Enable Cloud Asset Inventory across all projects and, if applicable, at the organization level to maintain authoritative asset and IAM histories. Centralize analysis, retain records per policy, and use the data to enforce least privilege and defense in depth.

Remediation

CLI

gcloud services enable cloudasset.googleapis.com --project <PROJECT_ID>

Terraform

resource "google_project_service" "<example_resource_name>" {
  project = "<example_project_id>"
  service = "cloudasset.googleapis.com" # Enables Cloud Asset Inventory API to pass the check
}

Other

1In the Google Cloud Console, select the project <PROJECT_ID> from the project picker.
2Go to APIs & Services > Library.
3Search for "Cloud Asset Inventory API" and select it.
4Click Enable.
5Verify it appears under APIs & Services > Enabled APIs & services.

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.serviceusage.serviceusage_client import (
    serviceusage_client,
)


class iam_cloud_asset_inventory_enabled(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for project_id in serviceusage_client.project_ids:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=serviceusage_client.projects[project_id],
                resource_id="cloudasset.googleapis.com",
                resource_name="Cloud Asset Inventory",
                project_id=project_id,
                location=serviceusage_client.region,
            )
            report.status = "FAIL"
            report.status_extended = (
                f"Cloud Asset Inventory is not enabled in project {project_id}."
            )
            for active_service in serviceusage_client.active_services.get(
                project_id, []
            ):
                if active_service.name == "cloudasset.googleapis.com":
                    report.status = "PASS"
                    report.status_extended = (
                        f"Cloud Asset Inventory is enabled in project {project_id}."
                    )
                    break
            findings.append(report)

        return findings

References