Google Cloud Asset Inventory
Google Cloud- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Google Cloud Asset connector integrates with Google Cloud Asset Inventory to synchronize Compute Engine virtual machine instances into the Brinqa platform as host assets. For every configured scope (organization, folder, or project) it searches all compute.googleapis.com/Instance resources, then enriches each one with its latest historical state so that network configuration, scheduling, attached service accounts, and instance-group membership are captured in a single host record. Resource labels are surfaced both as tags and as dynamically generated per-label attributes.
Data retrieved from Google Cloud Asset Inventory
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Compute Instance | Yes | Host |
For detailed steps on how to view the data retrieved from Google Cloud Asset Inventory in the Brinqa Platform, see How to view your data.
Providing an organization number enables collecting assets from all associated projects, including any new projects added after you set up the integration. The credentials you provide must have organization-level permissions.
Connection settings
When setting up a data integration, select Google Cloud Asset Inventory from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Scope | Yes | — | The relative name of the root asset. It can only be an organization number (such as "organizations/123"), a project ID \ |
| Credentials | Yes | — | This is the full content of the JSON file that contains your service account key. |
| Page size | No | 100 | Maximum number of records to get per API request |
Authentication
The connector authenticates with Google Cloud APIs using a service account JSON key. The full JSON contents of the key are supplied in the credentials configuration property and are used by the Google client libraries to mint OAuth 2.0 access tokens for every Cloud Asset Inventory API call. Token acquisition and refresh are handled transparently by the Google Auth library — the connector never handles the bearer token directly.
Required Elements
| Element | Description |
|---|---|
| Method | OAuth 2.0 with a service account JSON key |
| Scope | Comma-separated list of GCP scopes: organizations/{org}, folders/{folderId}, and/or projects/{projectId} |
| Credentials | Full JSON contents of a GCP service account key with read access to Cloud Asset Inventory and Compute Engine resources |
| Token endpoint | https://oauth2.googleapis.com/token (handled by the Google Auth library) |
Usage
The credentials and scope list are read once per sync. For each scope, the connector calls Cloud Asset Inventory SearchAllResources to list compute instances and BatchGetAssetsHistory to pull the latest temporal state of each instance. The Google client libraries attach the OAuth 2.0 access token to each gRPC/REST request automatically.
Sync Behavior
The connector performs full syncs. Although a since (Instant) value is accepted by the connector contract, the Cloud Asset Inventory resource search is not filtered by it — every sync enumerates all in-scope Compute Engine instances and resolves each to its latest historical state.
How to obtain Google Cloud Asset Inventory credentials
Obtain the required credentials (scope, credentials) from your Google Cloud Asset Inventory administrator or the Google Cloud Asset Inventory admin console, then enter them in the connection settings above.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Compute Instance
| Source Field Name | SDM Attribute |
|---|---|
additionalAttributes.externalIPs[] / accessConfigs[].natIP | PUBLIC_IP_ADDRESSES |
additionalAttributes.internalIPs[] / networkInterfaces[].networkIP | PRIVATE_IP_ADDRESSES |
additionalAttributes.osLongName / osShortName | OPERATING_SYSTEM |
asset data.canIpForward | CAN_IP_FORWARD |
asset data.cpuPlatform | CPU_PLATFORM |
asset data.labels (key:value) | TAGS |
asset data.labels[<key>] | *<LABEL> (dynamic) |
asset data.lastStartTimestamp | LAST_STARTED |
asset data.lastStopTimestamp | LAST_STOPPED |
asset data.machineType (last segment) | MACHINE_TYPE |
asset data.networkInterfaces[].accessConfigs[].networkTier | NETWORK_TIER |
asset data.networkInterfaces[].network (last segment) | NETWORK |
asset data.networkInterfaces[].subnetwork (last segment) | SUBNET |
asset data.scheduling.automaticRestart | AUTO_RESTART |
asset data.scheduling.preemptible | PREEMPTIBLE |
asset data.serviceAccounts[].email | SERVICE_ACCOUNTS |
asset TemporalAsset.deleted | DELETED |
| ASSET_CATEGORY_VIRTUAL_MACHINE | CATEGORIES |
Instant.now() if active, else last stop/start/create/update timestamp | LAST_SEEN |
| resource assetType then asset assetType | TYPE |
resource createTime / asset data.creationTimestamp | FIRST_SEEN |
resource createTime / asset data.creationTimestamp | SOURCE_CREATED_DATE |
resource description / asset data.description, else composed from OS name + machine type | DESCRIPTION |
| resource displayName | NAME |
resource id (fallback: asset data.id) | INSTANCE_ID |
resource id (fallback: asset data.id, then resource name) | UID |
resource location / asset data.zone | ZONE |
resource networkTags[] | NETWORK_TAGS |
resource organization / asset ancestors (organizations/...) | ORG_ID |
| resource parentFullResourceName / asset name segment | PROJECT_NAME |
resource project / asset ancestors (projects/...) | PROJECT_ID |
resource relationship INSTANCE_TO_INSTANCEGROUPMANAGER (last segment) | INSTANCE_GROUP_MANAGERS |
resource state / asset data.status (normalized) | STATUS |
| resource updateTime / asset updateTime | SOURCE_LAST_MODIFIED |
resource/asset data.deletionProtection | DELETE_PROTECTION |
| union of public + private IPs | IP_ADDRESSES |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Compute Instance
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Compute Instance on every run and applies no incremental date filter.
API
- Type: REST — Cloud Asset Inventory (SearchAllResources + BatchGetAssetsHistory) · Endpoint:
POST https://cloudasset.googleapis.com/v1/{scope}:searchAllResources
Changelog
The Google Cloud Asset Inventory connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.3.1 | Bug Fixes - Fixed connector failures during Google Cloud operations on certain platform versions. A dependency packaging issue caused the connector to rely on the platform's internal libraries, leading to initialization errors on platforms 11.x and 12.x. The connector now bundles all required dependencies independently. | N/A |
| 3.3.0 | No changes in this release. | N/A |
| 3.2.16 | No changes in this release. | N/A |
| 3.2.15 | No changes in this release. | N/A |
| 3.2.14 | No changes in this release. | N/A |
| 3.2.13 | No changes in this release. | N/A |
| 3.2.12 | No changes in this release. | N/A |
| 3.2.11 | Improvements Dependency Upgrades - Updated bundled Google Cloud client libraries and resolved a grpc-api dependency conflict to improve runtime stability. | N/A |
| 3.2.10 | No changes in this release. | N/A |
| 3.2.9 | Improvements - Compute Instances now report the managed instance groups they belong to, making it easier to trace instances back to their autoscaling and deployment groups. - Improved diagnostic logging when asset searches fail, so connectivity and permission problems are easier to troubleshoot. | N/A |
| 3.2.8 | No changes in this release. | N/A |
| 3.2.7 | No changes in this release. | N/A |
| 3.2.6 | No changes in this release. | N/A |
| 3.2.5 | No changes in this release. | N/A |
| 3.2.4 | No changes in this release. | N/A |
| 3.2.3 | No changes in this release. | N/A |
| 3.2.2 | No changes in this release. | N/A |
| 3.2.1 | No changes in this release. | N/A |
| 3.2.0 | No changes in this release. | N/A |
| 3.1.3 | No changes in this release. | N/A |
| 3.1.1 | No changes in this release. | N/A |
| 3.1.0 | Improvements - Compute Instances with multiple public IP addresses are now captured fully instead of only the first address. | • Compute Instance: The public IP identifier changed from a single value to a multi-valued field. Re-sync the connector so existing Compute Instances are matched on the updated identifier. |
| 3.0.10 | No changes in this release. | N/A |
| 3.0.9 | Improvements - Compute Instance labels are now also surfaced as a consolidated set of key:value tags, making label-based searching and grouping easier. | N/A |
| 3.0.8 | Improvements - Standardized how the unique identifier for Compute Instances is determined, improving consistency of instance matching across syncs. | • Compute Instance: The unique identifier logic was updated. Re-sync the connector so existing Compute Instances are reconciled against the new identifier. |
| 3.0.7 | Improvements - The asset category attribute on Compute Instances now supports multiple values. | • Compute Instance: The category attribute was renamed and converted to a multi-valued field. Re-sync the connector so the category data is repopulated correctly. |
| 3.0.6 | Improvements Dependency Upgrades - Updated bundled data-model dependencies. | N/A |
| 3.0.5 | Improvements - Compute Instances now capture all private IP addresses rather than a single value, giving a complete view of multi-NIC instances. | • Compute Instance: The private IP address attribute was renamed and converted to a multi-valued field, and the redundant single IP address attribute was removed. Re-sync the connector so the IP address data is repopulated correctly. |
| 3.0.4 | Improvements - Compute Instances now report when they were last started and last stopped. | • Compute Instance: The identifier used to match instances changed to the public IP address. Re-sync the connector so existing Compute Instances are reconciled against the new identifier. |
| 3.0.3 | Improvements Dependency Upgrades - Updated bundled data-model dependencies. | N/A |
| 3.0.2 | Improvements - Compute Instances are now uniquely identified by their instance ID, improving matching reliability when instance names are reused. | • Compute Instance: The unique identifier changed from the instance name to the instance ID. Re-sync the connector so existing Compute Instances are reconciled against the new identifier. |
| 3.0.1 | No changes in this release. | N/A |
| 3.0.0 | Overview The Google Cloud Asset connector integrates with Google Cloud Asset Inventory to synchronize compute infrastructure assets across your Google Cloud organization. Category: Google Cloud Models | N/A |