CloudGraph GCP Provider

Use the CloudGraph GCP Provider to scan and normalize cloud infrastructure using the GCP Client Libraries

• CloudGraph GCP Provider
• Install
• Authentication
• Multi Account
• Configuration
• Supported Services

Install

Install the GCP provider in CloudGraph

cg init gcp

Authentication

Authenticate the CloudGraph GCP Provider using service account keys:

• Create service account key(s)

Multi Account

CloudGraph is able to scan multiple GCP service accounts at once. This is done by entering a project ID and the service account key file location for each service account when running cg init. All resources will be tagged with a projectId so you can query resources specific to a project or query resources across accounts!

Configuration

CloudGraph creates a configuration file at:

• UNIX: ~/.config/cloudgraph/.cloud-graphrc.json
• Windows: %LOCALAPPDATA%\cloudgraph/.cloud-graphrc.json

NOTE: CloudGraph will output where it stores the configuration file and provider data as part of the cg init command

CloudGraph will generate this configuration file when you run cg init gcp. You may update it manually or by running cg init gcp again.

"gcp": {
  "accounts": [
    {
      "projectId": "autocloud-sandbox",
      "keyFilename": "/Users/me/autocloud-sandbox.json"
    },
    {
      "projectId": "cloudgraph-sample",
      "keyFilename": "/Users/me/cloudgraph-sample.json"
    }
  ],
  "regions": "us-central1,us-east1",
  "resources": "vpc,project"
}

CloudGraph GCP Provider will ask you what regions you would like to crawl and will by default crawl for all supported resources in selected regions in the default account. You can update the regions or resources fields in the cloud-graphrc.json file to change this behavior. You can also select which resources to crawl in the cg init gcp command by passing the the -r flag: cg init gcp -r

Supported Services

Service	Relations
accessApproval	project
aiPlatformNotebooks	project, kmsCryptoKeys, network, subnet
alertPolicy	project
apiGatewayGateways	project, apiGatewayApis, apiGatewayApiConfigs
apiGatewayApis	project, apiGatewayGateways
apiGatewayApiConfigs	project, apiGatewayGateways
apiKeys	project
assets	project
bigQueryDataset	project
bigQueryConnection	project
bigQueryDataTransfer	bigQueryDataTransferRun, project
bigQueryDataTransferRun	project
bigQueryReservation	project
bigQueryReservationCapacityCommitment	project
cdnBackendBucket	project, cdnUrlMap
cdnBackendService	project, cdnUrlMap, network
cdnUrlMap	project, cdnBackendBucket, cdnBackendService
cloudFunction	project, vpcConnectors
cloudRouters	project
computeProject	project
dataprocClusters	project, dataprocJobs, dataprocWorkflowTemplates
dataprocAutoscalingPolicies	project
dataprocJobs	project, dataprocClusters
dataprocWorkflowTemplates	project, dataprocClusters
kmsCryptoKeys	aiPlatformNotebooks, iamPolicy, kmsKeyRing, project
dnsManagedZone	project
dnsPolicy	project, network
essentialContacts	project
firestoreDatabases	project
firewall	network, project
folder	iamPolicy, organization, project
kmsKeyRing	kmsCryptoKeys, project
iamPolicy	folder, kmsCryptoKeys, project
logBucket	logView, project
logMetric	project
logSink	project
logView	logBucket, project
network	cloudRouters, dnsPolicy, firewall, project, sqlInstances, subnet, vmInstance, vpcConnectors, cdnBackendService, aiPlatformNotebooks
organization	folder, project
project	ALL SERVICES
secretManager	project
serviceAccounts	project
sqlInstances	project, network
sslPolicies	project, targetHttpsProxies, targetSslProxies
storageBucket	project
subnet	project, network, vmInstance, vpcConnectors, aiPlatformNotebooks
targetSslProxies	project, sslPolicies
targetHttpsProxies	project, sslPolicies
vmInstance	project, network, subnet
vpcConnectors	cloudFunction, project, network, subnet