Google Cloud Asset Inventory
Google Cloud- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Google Cloud Asset connector integrates with Google Cloud Asset Inventory to synchronize Compute Engine virtual machine instances into the Brinqa platform as host assets. For every configured scope (organization, folder, or project) it searches all compute.googleapis.com/Instance resources, then enriches each one with its latest historical state so that network configuration, scheduling, attached service accounts, and instance-group membership are captured in a single host record. Resource labels are surfaced both as tags and as dynamically generated per-label attributes.
Data retrieved from Google Cloud Asset Inventory
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Compute Instance | Yes | Host |
Model relationships
For detailed steps on how to view the data retrieved from Google Cloud Asset Inventory in the Brinqa Platform, see How to view your data.
Providing an organization number enables collecting assets from all associated projects, including any new projects added after you set up the integration. The credentials you provide must have organization-level permissions.
Connection settings
When setting up a data integration, select Google Cloud Asset Inventory from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Scope | Yes | — | The relative name of the root asset. It can only be an organization number (such as "organizations/123"), a project ID (such as "projects/my-project-id")", or a project number (such as"projects/12345"). Authorization requires the following Google IAM permission on the specified resource scope: cloudasset.assets.searchAllResources |
| Credentials | Yes | — | This is the full content of the JSON file that contains your service account key. |
| Page size | No | 100 | Maximum number of records to get per API request |
| Retry max attempts | No | 8 | How many times to retry a Google API request that fails with a temporary error before giving up. Raise it if syncs fail during Google service disruptions. |
| RPC timeout (seconds) | No | 480 | How long (in seconds) to wait for a single Google API request before giving up on it. Raise it for very large environments where requests run slowly. |
| Retry total timeout (minutes) | No | 15 | Total time (in minutes) the connector keeps retrying a failing request before failing the sync. Raise it to ride out longer outages or rate limiting. |
Authentication
The connector authenticates with Google Cloud APIs using a service account JSON key. The full JSON contents of the key are supplied in the credentials configuration property and are used by the Google client libraries to mint OAuth 2.0 access tokens for every Cloud Asset Inventory API call. Token acquisition and refresh are handled transparently by the Google Auth library — the connector never handles the bearer token directly.
Required Elements
| Element | Description |
|---|---|
| Method | OAuth 2.0 with a service account JSON key |
| Scope | Comma-separated list of GCP scopes: organizations/{org}, folders/{folderId}, and/or projects/{projectId} |
| Credentials | Full JSON contents of a GCP service account key with read access to Cloud Asset Inventory and Compute Engine resources |
| Token endpoint | https://oauth2.googleapis.com/token (handled by the Google Auth library) |
Usage
The credentials and scope list are read once per sync. For each scope, the connector calls Cloud Asset Inventory SearchAllResources to list compute instances and BatchGetAssetsHistory to pull the latest temporal state of each instance. The Google client libraries attach the OAuth 2.0 access token to each gRPC/REST request automatically.
Sync Behavior
The connector performs full syncs. Although a since (Instant) value is accepted by the connector contract, the Cloud Asset Inventory resource search is not filtered by it — every sync enumerates all in-scope Compute Engine instances and resolves each to its latest historical state.
Cloud Asset Inventory requests are retried on transient Google API errors — including quota RESOURCE_EXHAUSTED responses — using jittered exponential backoff bounded by an overall retry budget, so rate limiting and brief service disruptions are less likely to abort the sync. Retry and timeout behavior is tunable via the configuration properties below.
How to obtain Google Cloud Asset Inventory credentials
Obtain the required credentials (scope, credentials) from your Google Cloud Asset Inventory administrator or the Google Cloud Asset Inventory admin console, then enter them in the connection settings above.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Compute Instance
| Source Field Name | SDM Attribute |
|---|---|
additionalAttributes.externalIPs[] / accessConfigs[].natIP | PUBLIC_IP_ADDRESSES |
additionalAttributes.internalIPs[] / networkInterfaces[].networkIP | PRIVATE_IP_ADDRESSES |
additionalAttributes.osLongName / osShortName | OPERATING_SYSTEM |
asset data.canIpForward | CAN_IP_FORWARD |
asset data.cpuPlatform | CPU_PLATFORM |
asset data.labels (key:value) | TAGS |
asset data.labels[<key>] | *<LABEL> (dynamic) |
asset data.lastStartTimestamp | LAST_STARTED |
asset data.lastStopTimestamp | LAST_STOPPED |
asset data.machineType (last segment) | MACHINE_TYPE |
asset data.networkInterfaces[].accessConfigs[].networkTier | NETWORK_TIER |
asset data.networkInterfaces[].network (last segment) | NETWORK |
asset data.networkInterfaces[].subnetwork (last segment) | SUBNET |
asset data.scheduling.automaticRestart | AUTO_RESTART |
asset data.scheduling.preemptible | PREEMPTIBLE |
asset data.serviceAccounts[].email | SERVICE_ACCOUNTS |
asset TemporalAsset.deleted | DELETED |
| ASSET_CATEGORY_VIRTUAL_MACHINE | CATEGORIES |
Compute Engine listManagedInstances (zonal + regional), matched by instance id | INSTANCE_GROUP_MANAGERS |
Instant.now() at sync start | LAST_CAPTURED |
Instant.now() if active, else last stop/start/create/update timestamp | LAST_SEEN |
| resource assetType then asset assetType | TYPE |
resource createTime / asset data.creationTimestamp | FIRST_SEEN |
resource createTime / asset data.creationTimestamp | SOURCE_CREATED_DATE |
resource description / asset data.description, else composed from OS name + machine type | DESCRIPTION |
| resource displayName | NAME |
resource id (fallback: asset data.id) | INSTANCE_ID |
resource id (fallback: asset data.id, then resource name) | UID |
resource location / asset data.zone | ZONE |
resource networkTags[] | NETWORK_TAGS |
resource organization / asset ancestors (organizations/...) | ORG_ID |
| resource parentFullResourceName / asset name segment | PROJECT_NAME |
resource project / asset ancestors (projects/...) | PROJECT_ID |
resource state / asset data.status (normalized) | STATUS |
| resource updateTime / asset updateTime | SOURCE_LAST_MODIFIED |
resource/asset data.deletionProtection | DELETE_PROTECTION |
| union of public + private IPs | IP_ADDRESSES |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Compute Instance
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
fetch_instance_group_managers | Boolean | false | When enabled, resolves the managed instance groups each Compute Instance belongs to via the Compute Engine managed-instances API and populates INSTANCE_GROUP_MANAGERS. Requires the compute.instanceGroupManagers.list and compute.instanceGroupManagers.get permissions. |
Delta sync
Not supported. The connector performs a full sync of Compute Instance on every run and applies no incremental date filter.
API
- Type: REST — Cloud Asset Inventory (SearchAllResources + BatchGetAssetsHistory); Compute Engine (listManagedInstances) when
fetch_instance_group_managersis enabled · Endpoint:POST https://cloudasset.googleapis.com/v1/{scope}:searchAllResources(assetTypes=compute.googleapis.com/Instance), thenPOST https://cloudasset.googleapis.com/v1/{scope}:batchGetAssetsHistoryper matched instance. Whenfetch_instance_group_managersis enabled, the connector also searchescompute.googleapis.com/InstanceGroupManagerresources and calls the Compute EnginelistManagedInstancesAPI (zonal and regional) to map instances to their managed groups.
Changelog
The Google Cloud Asset Inventory connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.3.8 | New Features - Configurable Google API retry and timeout controls — New connector settings let administrators tune how Cloud Asset API calls (asset listings, resource searches, and asset-history lookups) handle transient Google API failures: maximum retry attempts ( retryMaxAttempts), per-request timeout (rpcTimeoutSeconds), and the overall retry time budget (retryTotalTimeoutMinutes). All settings have sensible defaults, so existing connectors require no configuration. Improvements - More resilient Cloud Asset API calls under rate limiting — Google API quota errors ( RESOURCE_EXHAUSTED) on Cloud Asset operations — asset listings, resource searches, and asset-history lookups — are now retried with jittered exponential backoff, and retries apply a bounded overall time budget that is separate from the per-request timeout, so rate limiting and brief service disruptions are less likely to abort a sync. | N/A |
| 3.3.7 | No changes in this release. | N/A |
| 3.3.6 | No changes in this release. | N/A |
| 3.3.5 | No changes in this release. | N/A |
| 3.3.4 | No changes in this release. | N/A |
| 3.3.3 | New Features - Added an optional fetch_instance_group_managers sync option. When enabled, Compute Instances report the managed instance groups they belong to, retrieved directly from the Compute Engine API. This option is off by default and, when turned on, requires the compute.instanceGroupManagers.list and compute.instanceGroupManagers.get permissions. Improvements - Made managed instance group associations more reliable by resolving them from the Compute Engine managed-instances API instead of Cloud Asset relationship data, which was often incomplete. - Added a "Last Captured" attribute to Compute Instances that records the timestamp of the most recent sync in which each instance was seen. | N/A |
| 3.3.2 | No changes in this release. | N/A |
| 3.3.1 | Bug Fixes - Fixed connector failures during Google Cloud operations on certain platform versions. A dependency packaging issue caused the connector to rely on the platform's internal libraries, leading to initialization errors on platforms 11.x and 12.x. The connector now bundles all required dependencies independently. | N/A |
| 3.3.0 | No changes in this release. | N/A |
| 3.2.16 | No changes in this release. | N/A |
| 3.2.15 | No changes in this release. | N/A |
| 3.2.14 | No changes in this release. | N/A |
| 3.2.13 | No changes in this release. | N/A |
| 3.2.12 | No changes in this release. | N/A |
| 3.2.11 | Improvements Dependency Upgrades - Updated bundled Google Cloud client libraries and resolved a grpc-api dependency conflict to improve runtime stability. | N/A |
| 3.2.10 | No changes in this release. | N/A |
| 3.2.9 | Improvements - Compute Instances now report the managed instance groups they belong to, making it easier to trace instances back to their autoscaling and deployment groups. - Improved diagnostic logging when asset searches fail, so connectivity and permission problems are easier to troubleshoot. | N/A |
| 3.2.8 | No changes in this release. | N/A |
| 3.2.7 | No changes in this release. | N/A |
| 3.2.6 | No changes in this release. | N/A |
| 3.2.5 | No changes in this release. | N/A |
| 3.2.4 | No changes in this release. | N/A |
| 3.2.3 | No changes in this release. | N/A |
| 3.2.2 | No changes in this release. | N/A |
| 3.2.1 | No changes in this release. | N/A |
| 3.2.0 | No changes in this release. | N/A |
| 3.1.3 | No changes in this release. | N/A |
| 3.1.1 | No changes in this release. | N/A |
| 3.1.0 | Improvements - Compute Instances with multiple public IP addresses are now captured fully instead of only the first address. | • Compute Instance: The public IP identifier changed from a single value to a multi-valued field. Re-sync the connector so existing Compute Instances are matched on the updated identifier. |
| 3.0.10 | No changes in this release. | N/A |
| 3.0.9 | Improvements - Compute Instance labels are now also surfaced as a consolidated set of key:value tags, making label-based searching and grouping easier. | N/A |
| 3.0.8 | Improvements - Standardized how the unique identifier for Compute Instances is determined, improving consistency of instance matching across syncs. | • Compute Instance: The unique identifier logic was updated. Re-sync the connector so existing Compute Instances are reconciled against the new identifier. |
| 3.0.7 | Improvements - The asset category attribute on Compute Instances now supports multiple values. | • Compute Instance: The category attribute was renamed and converted to a multi-valued field. Re-sync the connector so the category data is repopulated correctly. |
| 3.0.6 | Improvements Dependency Upgrades - Updated bundled data-model dependencies. | N/A |
| 3.0.5 | Improvements - Compute Instances now capture all private IP addresses rather than a single value, giving a complete view of multi-NIC instances. | • Compute Instance: The private IP address attribute was renamed and converted to a multi-valued field, and the redundant single IP address attribute was removed. Re-sync the connector so the IP address data is repopulated correctly. |
| 3.0.4 | Improvements - Compute Instances now report when they were last started and last stopped. | • Compute Instance: The identifier used to match instances changed to the public IP address. Re-sync the connector so existing Compute Instances are reconciled against the new identifier. |
| 3.0.3 | Improvements Dependency Upgrades - Updated bundled data-model dependencies. | N/A |
| 3.0.2 | Improvements - Compute Instances are now uniquely identified by their instance ID, improving matching reliability when instance names are reused. | • Compute Instance: The unique identifier changed from the instance name to the instance ID. Re-sync the connector so existing Compute Instances are reconciled against the new identifier. |
| 3.0.1 | No changes in this release. | N/A |
| 3.0.0 | Overview The Google Cloud Asset connector integrates with Google Cloud Asset Inventory to synchronize compute infrastructure assets across your Google Cloud organization. Category: Google Cloud Models | N/A |