Querying assets

This topic shows you how to query the asset metadata for your project, folder, or organization without needing to export the data to a BigQuery table first.

Limitations

The query provided in the request must be a SELECT query.
Query results larger than 10GB are not supported.
Query results larger than 10MB or 1000 rows are always paginated.
Queries must not take longer than 6 hours to process.
Legacy BigQuery SQL isn't supported.
Query results can only be saved in a BigQuery dataset in the US multi-region.
For Google Kubernetes Engine resources listed on the supported asset types page, only container.googleapis.com/Cluster and container.googleapis.com/NodePool are supported.
For new subscriptions to Security Command Center Premium tier, it can take up to 6 hours to get access to the API, and up to 48 hours for historical data to be ready.

Before you begin

Before you begin, complete the following steps.

Enable the Cloud Asset Inventory API on the project where you'll be running the API commands.

Enable the Cloud Asset Inventory API
Configure the permissions that are required to call the Cloud Asset Inventory API using either the gcloud CLI or the API.
Complete the following steps to set up your environment.
gcloud CLI
To set up your environment to use the gcloud CLI to call the Cloud Asset Inventory API, install the Google Cloud CLI on your local client.
REST
To set up your environment to call the Cloud Asset Inventory API with the curl command, complete the following steps.
1. Confirm that you have access to the curl command.
2. Ensure that you grant your account one of the following roles on your project, folder, or organization.
  - Cloud Asset Viewer role (roles/cloudasset.viewer)
  - Owner basic role (roles/owner)
If you are exporting metadata from one project to another, make sure the exporting project's default Cloud Asset Inventory service account exists and has the correct permissions.

Permissions

The following list shows the permissions required for each ContentType in a request.

Content type		Permission
gcloud name	REST name
`access-policy`	`ACCESS_POLICY`	`cloudasset.assets.queryAccessPolicy`
`iam-policy`	`IAM_POLICY`	`cloudasset.assets.queryIamPolicy`
`os-inventory`	`OS_INVENTORY`	`cloudasset.assets.queryOSInventories`
`relationship`	`RELATIONSHIP`	`cloudasset.assets.queryResource`
`resource`	`RESOURCE`	`cloudasset.assets.queryResource`

The role you grant when you configure permissions (cloudasset.viewer or cloudasset.owner) contains these permissions.

Format a query

The Query Assets API requires that queries use a BigQuery Standard SQL-compatible dialect.

When querying for an asset, its name must follow a specific format. For example, a query looking for VMs would query for compute_googleapis_com_Instance. Learn more about supported asset types.

Names used in a query are transformed - / and . are replaced with _ (for example, compute.googleapis.com/Instance becomes compute_googleapis_com_Instance).

Table names in the dataset correspond to the asset type name. For content whose content_type is not RESOURCE, the table name is the content type in upper case (for example, IAM_POLICY, OS_INVENTORY, ACCESS_POLICY).

To query resource standard metadata across resource types, the table name is STANDARD_METADATA. The supported resource metadata includes all fields except resource.DATA, which is specific to a resource type.

You can refer to the schemas used by various assets in the Asset Inventory page in the Google Cloud console.

Field value response format

In a response, the schema and rows fields are similar to those in the BigQuery. Field metadata is relegated to a separate struct named schema. This format helps compress a potentially very large response by avoiding field name and type duplication. The values f and v are used instead of fields and value for the same reason.

This sample shows the response to a query for all assets of a given type with page-size of 2:

{
  "jobReference": "CiBqb2JfTHhIQ2xCeXlJejc1bHdQSTRNZ3NEVndXU2o5QxIBARjLq-_g5fO5t1I",
  "done": true,
  "queryResult": {
    "rows": [
      {
        "f": [
          {
            "v": "//compute.googleapis.com/projects/PROJECT1/zones/us-central1-a/instances/INSTANCE1"
          },
          {
            "v": "compute.googleapis.com/Instance"
          }
        ]
      },
      {
        "f": [
          {
            "v": "//compute.googleapis.com/projects/PROJECT2/zones/us-central1-a/instances/INSTANCE2"
          },
          {
            "v": "compute.googleapis.com/Instance"
          }
        ]
      }
    ],
    "schema": {
      "fields": [
        {
          "field": "name",
          "type": "STRING",
          "mode": "NULLABLE",
          "fields": []
        },
        {
          "field": "assetType",
          "type": "STRING",
          "mode": "NULLABLE",
          "fields": []
        }
      ]
    },
    "nextPageToken": "BHKVJIOAPUAQAAASA4EAAEEAQCAAKGQIBABBB7X7777QOIFQVYKQ====",
    "totalRows": "11"
  }
}

Query in Google Cloud console

Console

To query the asset metadata for your project, folder, or organization, complete the following steps:

Go to the Asset Inventory page in the Google Cloud console.

Go to Asset Inventory
To set the scope for your search, select a project, folder, or organization.
Click the Asset query tab.
To query asset metadata, either use a sample query or build your own:
- To use a sample, click an entry in the Query library tab to preview the query. Click Apply to copy that sample into the Edit query box, then either edit the query, or click Run to execute it.
- To build your own query, enter the query text directly into the Edit query box, then click Run to execute it. To assist in writing your own query, you can click a table in the Select table pane to preview its schema and content. Learn more Query syntax.
The asset metadata matching the query is shown in the Query result tab.
Optional: To download the query result sets in CSV format, click Export.

The maximum size of the CSV file is 2 MB. If the download request fails because the file size exceeds this limit, a message appears with instructions for exporting the full results.

Save query results

Query results are returned as Query Assets API responses. To export the results to your own BigQuery table, specify a BigQuery destination in the request. If you don't already have one, you must create a BigQuery dataset before making these requests.

gcloud

Projects

gcloud asset query \
    --project=PROJECT_ID \
    --billing-project=BILLING_PROJECT_ID \
    --statement="
      SELECT
        name, assetType
      FROM
        compute_googleapis_com_Instance
      LIMIT 2" \
    --bigquery-table=projects/PROJECT_ID/datasets/DATASET_ID/tables/TABLE_NAME \
    --write-disposition="write-truncate"

Provide the following values:

PROJECT_ID: The ID of the project whose metadata you want to query.
BILLING_PROJECT_ID: Optional. The project ID that the default Cloud Asset Inventory service agent is in that has permissions to write to BigQuery. Not required if you've already switched to the billing project with gcloud config set project. Read more about billing projects.
DATASET_ID: The ID of the BigQuery dataset.
TABLE_NAME: The table you're exporting your metadata to. If it doesn't exist, it's created.

Other flags:

--write-disposition: Specifies the action that occurs if the BigQuery destination table or partition already exists by setting the write disposition. The following values are supported:
- write-truncate: If the table or partition already exists, BigQuery overwrites the entire table or all partitions data.
- write-append: If the table or partition already exists, BigQuery appends the data to the table or the latest partition.
- write-empty: If the table already exists and contains data, a duplicate error is returned in the job result.
The default value is write-empty.

Folders

gcloud asset query \
    --folder=FOLDER_ID \
    --billing-project=BILLING_PROJECT_ID \
    --statement="
      SELECT
        name, assetType
      FROM
        compute_googleapis_com_Instance
      LIMIT 2" \
    --bigquery-table=projects/PROJECT_ID/datasets/DATASET_ID/tables/TABLE_NAME \
    --write-disposition="write-truncate"

Provide the following values:

FOLDER_ID: The ID of the folder whose metadata you want to query.
How to find a Google Cloud folder ID
Console

To find a Google Cloud folder ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI

You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:

gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"

Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.

To get the ID of a folder within another folder, list the subfolders:

gcloud resource-manager folders list --folder=FOLDER_ID
BILLING_PROJECT_ID: Optional. The project ID that the default Cloud Asset Inventory service agent is in that has permissions to write to BigQuery. Not required if you've already switched to the billing project with gcloud config set project. Read more about billing projects.
PROJECT_ID: The ID of the project that the BigQuery table is in.
DATASET_ID: The ID of the BigQuery dataset.
TABLE_NAME: The table you're exporting your metadata to. If it doesn't exist, it's created.

Other flags:

--write-disposition: Specifies the action that occurs if the BigQuery destination table or partition already exists by setting the write disposition. The following values are supported:
- write-truncate: If the table or partition already exists, BigQuery overwrites the entire table or all partitions data.
- write-append: If the table or partition already exists, BigQuery appends the data to the table or the latest partition.
- write-empty: If the table already exists and contains data, a duplicate error is returned in the job result.
The default value is write-empty.

Organizations

gcloud asset query \
    --organization=ORGANIZATION_ID \
    --billing-project=BILLING_PROJECT_ID \
    --statement="
      SELECT
        name, assetType
      FROM
        compute_googleapis_com_Instance
      LIMIT 2" \
    --bigquery-table=projects/PROJECT_ID/datasets/DATASET_ID/tables/TABLE_NAME \
    --write-disposition="write-truncate"

Provide the following values:

ORGANIZATION_ID: The ID of the organization whose metadata you want to query.
How to find a Google Cloud organization ID
Console

To find a Google Cloud organization ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI

You can retrieve a Google Cloud organization ID with the following command:

gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
BILLING_PROJECT_ID: Optional. The project ID that the default Cloud Asset Inventory service agent is in that has permissions to write to BigQuery. Not required if you've already switched to the billing project with gcloud config set project. Read more about billing projects.
PROJECT_ID: The ID of the project that the BigQuery table is in.
DATASET_ID: The ID of the BigQuery dataset.
TABLE_NAME: The table you're exporting your metadata to. If it doesn't exist, it's created.

Other flags:

--write-disposition: Specifies the action that occurs if the BigQuery destination table or partition already exists by setting the write disposition. The following values are supported:
- write-truncate: If the table or partition already exists, BigQuery overwrites the entire table or all partitions data.
- write-append: If the table or partition already exists, BigQuery appends the data to the table or the latest partition.
- write-empty: If the table already exists and contains data, a duplicate error is returned in the job result.
The default value is write-empty.

Here's a sample response for a successful request that saves the query results to a specified BigQuery destination table:

done: true
jobReference: CiBqb2JfMkpzOERxN2l5RnRKeWJQRksxWUlmYkxWNTUzbhIBARixoYOcs9T_qcgB
outputConfig:
  bigqueryDestination:
    dataset: projects/test-project/datasets/my_dataset
    table: my-table
    writeDisposition: write-truncate

Here's a sample response for a job that failed to save the query results:

done: true
error:
  code: 9
  message: '1 errors encountered during query: notFound'
jobReference: CiBqb2JfZWlmOUNsVFQ3b05hVzhpYkdVZ291dkZXc1VFXxIBARj73sbsmLmE1BggAQ

REST

curl -X POST \
     -H "X-Goog-User-Project: BILLING_PROJECT_ID" \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json" \
     -d '{
          "statement": "
            SELECT
              name, assetType
            FROM
              compute_googleapis_com_Instance
            LIMIT 2",
          "outputConfig": {
            "bigqueryDestination": {
              "dataset": "projects/PROJECT_ID/datasets/DATASET_ID",
              "table": "TABLE_NAME",
              "writeDisposition": "WRITE_TRUNCATE"
            }
          }
         }' \
     https://cloudasset.googleapis.com/v1/SCOPE:queryAssets

Provide the following values:

BILLING_PROJECT_ID: The project ID that the default Cloud Asset Inventory service agent is in that has permissions to manage your BigQuery datasets and tables. Read more about billing projects.
PROJECT_ID: The ID of the project that the BigQuery table is in.
DATASET_ID: The ID of the BigQuery dataset.
TABLE_NAME: The table you're exporting your metadata to. If it doesn't exist, it's created.
SCOPE: A scope can be a project, a folder, or an organization.

The allowed values are:
- projects/PROJECT_ID
- projects/PROJECT_NUMBER
  How to find a Google Cloud project number
  Console
  
  To find a Google Cloud project number, complete the following steps:
  
  Go to the Dashboard page in the Google Cloud console.
  
  Go to Dashboard
  
  Click the switcher box in the menu bar.
  
  Select your organization from the Select from box, and then search for your project name.
  
  Click the project name to switch to that project. The project number is shown in the Project info card.
  
  gcloud CLI
  
  You can retrieve a Google Cloud project number with the following command:
  
  gcloud projects describe PROJECT_ID --format="value(projectNumber)"
- folders/FOLDER_ID
  How to find a Google Cloud folder ID
  Console
  
  To find a Google Cloud folder ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Search for your folder name. The folder ID is shown next to the folder name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
  
  gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
  
  Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.
  
  To get the ID of a folder within another folder, list the subfolders:
  
  gcloud resource-manager folders list --folder=FOLDER_ID
- organizations/ORGANIZATION_ID
  How to find a Google Cloud organization ID
  Console
  
  To find a Google Cloud organization ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Click the All tab. The organization ID is shown next to the organization name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud organization ID with the following command:
  
  gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

Other parameters:

writeDisposition: Specifies the action that occurs if the BigQuery destination table or partition already exists by setting the write disposition. The following values are supported:
- WRITE_TRUNCATE: If the table or partition already exists, BigQuery overwrites the entire table or all partitions data.
- WRITE_APPEND: If the table or partition already exists, BigQuery appends the data to the table or the latest partition.
- WRITE_EMPTY: If the table already exists and contains data, a duplicate error is returned in the job result.
The default value is WRITE_EMPTY.

Here's a sample response for a successful request that saves the query results to a specified BigQuery destination table:

{
  "jobReference": "CiBqb2JfZmNlbTZ5SjVZcHFKajVIYjMycFNSd2xSRlZXdBIBARiAnb6R1I63wdkB",
  "done": true,
  "outputConfig": {
    "bigqueryDestination": {
      "dataset": "projects/test-project/datasets/my_dataset",
      "table": "my-table",
      "writeDisposition": "WRITE_TRUNCATE"
    }
  }
}

Here's a sample response for a job that failed to save the query results:

{
  "jobReference": "CiBqb2JfZWlmOUNsVFQ3b05hVzhpYkdVZ291dkZXc1VFXxIBARj73sbsmLmE1BggAQ",
  "done": true,
  "error": {
    "code": 9,
    "message": "1 errors encountered during query: notFound"
  }
}

The schema and rows are not returned in the query response directly. You can view them in the specified BigQuery destination table.

Sample queries

Query assets

The following examples query assets in a project, folder, or organization.

gcloud

Projects

gcloud asset query \
    --project=PROJECT_ID \
    --statement="
      SELECT
        name, assetType
      FROM
        compute_googleapis_com_Instance
      LIMIT 2"

Provide the following values:

PROJECT_ID: The ID of the project whose metadata you want to query.

Folders

gcloud asset query \
    --folder=FOLDER_ID \
    --statement="
      SELECT
        name, assetType
      FROM
        compute_googleapis_com_Instance
      LIMIT 2"

Provide the following values:

FOLDER_ID: The ID of the folder whose metadata you want to query.
How to find a Google Cloud folder ID
Console

To find a Google Cloud folder ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI

You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:

gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"

Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.

To get the ID of a folder within another folder, list the subfolders:

gcloud resource-manager folders list --folder=FOLDER_ID

Organizations

gcloud asset query \
    --organization=ORGANIZATION_ID \
    --statement="
      SELECT
        name, assetType
      FROM
        compute_googleapis_com_Instance
      LIMIT 2"

Provide the following values:

ORGANIZATION_ID: The ID of the organization whose metadata you want to query.
How to find a Google Cloud organization ID
Console

To find a Google Cloud organization ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI

You can retrieve a Google Cloud organization ID with the following command:

gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

Here's a sample response for a successful request that returns all rows:

done: true
jobReference: CiBqb2JfMkpzOERxN2l5RnRKeWJQRksxWUlmYkxWNTUzbhIBARixoYOcs9T_qcgB
queryResult:
  nextPageToken: ''
  totalRows: '2'

name: //compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME
assetType: compute.googleapis.com/Instance

name: //compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/VM_INSTANCE_NAME
assetType; compute.googleapis.com/Instance

REST

curl -X POST \
     -H "X-Goog-User-Project: BILLING_PROJECT_ID" \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json" \
     -d '{
      "statement": "
        SELECT
          name, assetType
        FROM
          compute_googleapis_com_Instance
        LIMIT 2" }' \
     https://cloudasset.googleapis.com/v1/SCOPE:queryAssets

Provide the following values:

SCOPE: A scope can be a project, a folder, or an organization.

The allowed values are:
- projects/PROJECT_ID
- projects/PROJECT_NUMBER
  How to find a Google Cloud project number
  Console
  
  To find a Google Cloud project number, complete the following steps:
  
  Go to the Dashboard page in the Google Cloud console.
  
  Go to Dashboard
  
  Click the switcher box in the menu bar.
  
  Select your organization from the Select from box, and then search for your project name.
  
  Click the project name to switch to that project. The project number is shown in the Project info card.
  
  gcloud CLI
  
  You can retrieve a Google Cloud project number with the following command:
  
  gcloud projects describe PROJECT_ID --format="value(projectNumber)"
- folders/FOLDER_ID
  How to find a Google Cloud folder ID
  Console
  
  To find a Google Cloud folder ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Search for your folder name. The folder ID is shown next to the folder name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
  
  gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
  
  Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.
  
  To get the ID of a folder within another folder, list the subfolders:
  
  gcloud resource-manager folders list --folder=FOLDER_ID
- organizations/ORGANIZATION_ID
  How to find a Google Cloud organization ID
  Console
  
  To find a Google Cloud organization ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Click the All tab. The organization ID is shown next to the organization name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud organization ID with the following command:
  
  gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

Here's a sample response for a successful request that returns all rows:

{
  "jobReference": "CiBqb2JfZmNlbTZ5SjVZcHFKajVIYjMycFNSd2xSRlZXdBIBARiAnb6R1I63wdkB",
  "done": true,
  "queryResult": {
    "rows": [...],
    "schema": {...},
    "nextPageToken": "",
    "totalRows": "2"
  }
}

The schema and rows have been removed for readability. You can view them in Field Value Response format.

Query resource standard metadata across resource types

The following example queries the resource standard metadata field name and assetType across all resource types in a specific region.

gcloud

Projects

gcloud asset query \
    --project=PROJECT_ID \
    --statement="
      SELECT
        name,
        assetType
      FROM
        STANDARD_METADATA
      WHERE
        resource.location LIKE '%asia%'"

Provide the following values:

PROJECT_ID: The ID of the project whose metadata you want to query.

Folders

gcloud asset query \
    --folder=FOLDER_ID \
    --statement="
      SELECT
        name,
        assetType
      FROM
        STANDARD_METADATA
      WHERE
        resource.location LIKE '%asia%'"

Provide the following values:

FOLDER_ID: The ID of the folder whose metadata you want to query.
How to find a Google Cloud folder ID
Console

To find a Google Cloud folder ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI

You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:

gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"

Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.

To get the ID of a folder within another folder, list the subfolders:

gcloud resource-manager folders list --folder=FOLDER_ID

Organizations

gcloud asset query \
    --organization=ORGANIZATION_ID \
    --statement="
      SELECT
        name,
        assetType
      FROM
        STANDARD_METADATA
      WHERE
        resource.location LIKE '%asia%'"

Provide the following values:

ORGANIZATION_ID: The ID of the organization whose metadata you want to query.
How to find a Google Cloud organization ID
Console

To find a Google Cloud organization ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI

You can retrieve a Google Cloud organization ID with the following command:

gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

REST

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json" \
     -d '{
          "statement": "
            SELECT
              name,
              assetType
            FROM
              STANDARD_METADATA
            WHERE
              resource.location LIKE \"%asia%\""
         }' \
     https://cloudasset.googleapis.com/v1/SCOPE:queryAssets

Provide the following values:

SCOPE: A scope can be a project, a folder, or an organization.

The allowed values are:
- projects/PROJECT_ID
- projects/PROJECT_NUMBER
  How to find a Google Cloud project number
  Console
  
  To find a Google Cloud project number, complete the following steps:
  
  Go to the Dashboard page in the Google Cloud console.
  
  Go to Dashboard
  
  Click the switcher box in the menu bar.
  
  Select your organization from the Select from box, and then search for your project name.
  
  Click the project name to switch to that project. The project number is shown in the Project info card.
  
  gcloud CLI
  
  You can retrieve a Google Cloud project number with the following command:
  
  gcloud projects describe PROJECT_ID --format="value(projectNumber)"
- folders/FOLDER_ID
  How to find a Google Cloud folder ID
  Console
  
  To find a Google Cloud folder ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Search for your folder name. The folder ID is shown next to the folder name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
  
  gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
  
  Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.
  
  To get the ID of a folder within another folder, list the subfolders:
  
  gcloud resource-manager folders list --folder=FOLDER_ID
- organizations/ORGANIZATION_ID
  How to find a Google Cloud organization ID
  Console
  
  To find a Google Cloud organization ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Click the All tab. The organization ID is shown next to the organization name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud organization ID with the following command:
  
  gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

Fetching a response asynchronously by job reference

Run the following command which times out.

gcloud

Projects

gcloud asset query \
    --project=PROJECT_ID \
    --timeout="1s" \
    --statement="
    SELECT
      name, assetType
    FROM
      compute_googleapis_com_Instance";

Provide the following values:

PROJECT_ID: The ID of the project whose metadata you want to query.

When a request doesn't complete in time, its done field is set to false, which means the request didn't finish in time but is being processed. The following sample shows a response that indicates that the request isn't done processing.

done: false
job_reference: "JOB_REFERENCE_ID"

You can use this job reference ID to get the result asynchronously later with another API call:

gcloud asset query \
    --project=PROJECT_ID \
    --job-reference=JOB_REFERENCE_ID

Folders

gcloud asset query \
    --folder=FOLDER_ID \
    --timeout="1s" \
    --statement="
    SELECT
      name, assetType
    FROM
      compute_googleapis_com_Instance";

Provide the following values:

FOLDER_ID: The ID of the folder whose metadata you want to query.
How to find a Google Cloud folder ID
Console

To find a Google Cloud folder ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI

You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:

gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"

Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.

To get the ID of a folder within another folder, list the subfolders:

gcloud resource-manager folders list --folder=FOLDER_ID

done: false
job_reference: "JOB_REFERENCE_ID"

You can use this job reference ID to get the result asynchronously later with another API call:

gcloud asset query \
    --folder=FOLDER_ID \
    --job-reference=JOB_REFERENCE_ID

Organizations

gcloud asset query \
    --organization=ORGANIZATION_ID \
    --timeout="1s" \
    --statement="
    SELECT
      name, assetType
    FROM
      compute_googleapis_com_Instance";

Provide the following values:

ORGANIZATION_ID: The ID of the organization whose metadata you want to query.
How to find a Google Cloud organization ID
Console

To find a Google Cloud organization ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI

You can retrieve a Google Cloud organization ID with the following command:

gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

done: false
job_reference: "JOB_REFERENCE_ID"

You can use this job reference ID to get the result asynchronously later with another API call:

gcloud asset query \
    --organization=ORGANIZATION_ID \
    --job-reference=JOB_REFERENCE_ID

REST

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json" \
     -d '{
          "timeout": "1s",
          "statement": "
            SELECT
              name, assetType
            FROM
              compute_googleapis_com_Instance"
         }' \
     https://cloudasset.googleapis.com/v1/SCOPE:queryAssets

Provide the following values:

SCOPE: A scope can be a project, a folder, or an organization.

The allowed values are:
- projects/PROJECT_ID
- projects/PROJECT_NUMBER
  How to find a Google Cloud project number
  Console
  
  To find a Google Cloud project number, complete the following steps:
  
  Go to the Dashboard page in the Google Cloud console.
  
  Go to Dashboard
  
  Click the switcher box in the menu bar.
  
  Select your organization from the Select from box, and then search for your project name.
  
  Click the project name to switch to that project. The project number is shown in the Project info card.
  
  gcloud CLI
  
  You can retrieve a Google Cloud project number with the following command:
  
  gcloud projects describe PROJECT_ID --format="value(projectNumber)"
- folders/FOLDER_ID
  How to find a Google Cloud folder ID
  Console
  
  To find a Google Cloud folder ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Search for your folder name. The folder ID is shown next to the folder name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
  
  gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
  
  Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.
  
  To get the ID of a folder within another folder, list the subfolders:
  
  gcloud resource-manager folders list --folder=FOLDER_ID
- organizations/ORGANIZATION_ID
  How to find a Google Cloud organization ID
  Console
  
  To find a Google Cloud organization ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Click the All tab. The organization ID is shown next to the organization name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud organization ID with the following command:
  
  gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

{
  "jobReference": "JOB_REFERENCE_ID",
  "done": false,
  "queryResult": {
    "rows": [],
    "schema": {
      "fields": []
    },
    "nextPageToken": "",
    "totalRows": "0"
  }
}

You can use this job reference ID to get the result asynchronously later with another API call:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json" \
     -d '{
          "jobReference": "JOB_REFERENCE_ID"
         }' \
     https://cloudasset.googleapis.com/v1/SCOPE:queryAssets

Fetching the next page of results for paginated requests with the REST API

Make the following query, which sets a pageSize of 1:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json" \
     -d '{
          "pageSize": "1",
          "statement": "
            SELECT
              name, assetType
            FROM
              compute_googleapis_com_Instance"
         }' \
     https://cloudasset.googleapis.com/v1/SCOPE:queryAssets

Provide the following values:

SCOPE: A scope can be a project, a folder, or an organization.

The allowed values are:
- projects/PROJECT_ID
- projects/PROJECT_NUMBER
  How to find a Google Cloud project number
  Console
  
  To find a Google Cloud project number, complete the following steps:
  
  Go to the Dashboard page in the Google Cloud console.
  
  Go to Dashboard
  
  Click the switcher box in the menu bar.
  
  Select your organization from the Select from box, and then search for your project name.
  
  Click the project name to switch to that project. The project number is shown in the Project info card.
  
  gcloud CLI
  
  You can retrieve a Google Cloud project number with the following command:
  
  gcloud projects describe PROJECT_ID --format="value(projectNumber)"
- folders/FOLDER_ID
  How to find a Google Cloud folder ID
  Console
  
  To find a Google Cloud folder ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Search for your folder name. The folder ID is shown next to the folder name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
  
  gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
  
  Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.
  
  To get the ID of a folder within another folder, list the subfolders:
  
  gcloud resource-manager folders list --folder=FOLDER_ID
- organizations/ORGANIZATION_ID
  How to find a Google Cloud organization ID
  Console
  
  To find a Google Cloud organization ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Click the All tab. The organization ID is shown next to the organization name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud organization ID with the following command:
  
  gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

Other parameters:

pageSize: The maximum number of resources to show per page.

The response has a nextPageToken that can be set in a request with jobReference to get the next page of responses.

{
  "jobReference": "JOB_REFERENCE_ID",
  "done": true,
  "queryResult": {
    "rows": [ ... ],
    "schema": { ... },
    "nextPageToken": "NEXT_PAGE_TOKEN",
    "totalRows": "11"
  }
}

The schema and rows have been removed for readability. You can view them in Field Value Response format.

You can get the next page of results by referencing the page token:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json" \
     -d '{
          "jobReference": "JOB_REFERENCE_ID",
          "pageToken": "NEXT_PAGE_TOKEN"
         }' \
     https://cloudasset.googleapis.com/v1/SCOPE:queryAssets

Query how many VMs are in each region

gcloud

Projects

gcloud asset query \
    --project=PROJECT_ID \
    --statement="
      SELECT
        resource.location,
        COUNT(*)
      FROM
        compute_googleapis_com_Instance
      GROUP BY
        resource.location"

Provide the following values:

PROJECT_ID: The ID of the project whose metadata you want to query.

Folders

gcloud asset query \
    --folder=FOLDER_ID \
    --statement="
      SELECT
        resource.location,
        COUNT(*)
      FROM
        compute_googleapis_com_Instance
      GROUP BY
        resource.location"

Provide the following values:

FOLDER_ID: The ID of the folder whose metadata you want to query.
How to find a Google Cloud folder ID
Console

To find a Google Cloud folder ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI

You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:

gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"

Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.

To get the ID of a folder within another folder, list the subfolders:

gcloud resource-manager folders list --folder=FOLDER_ID

Organizations

gcloud asset query \
    --organization=ORGANIZATION_ID \
    --statement="
      SELECT
        resource.location,
        COUNT(*)
      FROM
        compute_googleapis_com_Instance
      GROUP BY
        resource.location"

Provide the following values:

ORGANIZATION_ID: The ID of the organization whose metadata you want to query.
How to find a Google Cloud organization ID
Console

To find a Google Cloud organization ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI

You can retrieve a Google Cloud organization ID with the following command:

gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

REST

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json" \
     -d '{
          "statement": "
            SELECT
              resource.location,
              COUNT(*)
            FROM
              compute_googleapis_com_Instance
            GROUP BY
              resource.location"
         }' \
     https://cloudasset.googleapis.com/v1/SCOPE:queryAssets

Provide the following values:

SCOPE: A scope can be a project, a folder, or an organization.

The allowed values are:
- projects/PROJECT_ID
- projects/PROJECT_NUMBER
  How to find a Google Cloud project number
  Console
  
  To find a Google Cloud project number, complete the following steps:
  
  Go to the Dashboard page in the Google Cloud console.
  
  Go to Dashboard
  
  Click the switcher box in the menu bar.
  
  Select your organization from the Select from box, and then search for your project name.
  
  Click the project name to switch to that project. The project number is shown in the Project info card.
  
  gcloud CLI
  
  You can retrieve a Google Cloud project number with the following command:
  
  gcloud projects describe PROJECT_ID --format="value(projectNumber)"
- folders/FOLDER_ID
  How to find a Google Cloud folder ID
  Console
  
  To find a Google Cloud folder ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Search for your folder name. The folder ID is shown next to the folder name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
  
  gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
  
  Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.
  
  To get the ID of a folder within another folder, list the subfolders:
  
  gcloud resource-manager folders list --folder=FOLDER_ID
- organizations/ORGANIZATION_ID
  How to find a Google Cloud organization ID
  Console
  
  To find a Google Cloud organization ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Click the All tab. The organization ID is shown next to the organization name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud organization ID with the following command:
  
  gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

Query to identify the VMs in a specific region

gcloud

Projects

gcloud asset query \
    --project=PROJECT_ID \
    --statement="
      SELECT
        name,
        resource.DATA.creationTimestamp
      FROM
        compute_googleapis_com_Instance
      WHERE
        resource.location LIKE '%asia%'"

Provide the following values:

PROJECT_ID: The ID of the project whose metadata you want to query.

Folders

gcloud asset query \
    --folder=FOLDER_ID \
    --statement="
      SELECT
        name,
        resource.DATA.creationTimestamp
      FROM
        compute_googleapis_com_Instance
      WHERE
        resource.location LIKE '%asia%'"

Provide the following values:

FOLDER_ID: The ID of the folder whose metadata you want to query.
How to find a Google Cloud folder ID
Console

To find a Google Cloud folder ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI

You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:

gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"

Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.

To get the ID of a folder within another folder, list the subfolders:

gcloud resource-manager folders list --folder=FOLDER_ID

Organizations

gcloud asset query \
    --organization=ORGANIZATION_ID \
    --statement="
      SELECT
        name,
        resource.DATA.creationTimestamp
      FROM
        compute_googleapis_com_Instance
      WHERE
        resource.location LIKE '%asia%'"

Provide the following values:

ORGANIZATION_ID: The ID of the organization whose metadata you want to query.
How to find a Google Cloud organization ID
Console

To find a Google Cloud organization ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI

You can retrieve a Google Cloud organization ID with the following command:

gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

REST

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json" \
     -d '{
          "statement": "
            SELECT
              name,
              resource.DATA.creationTimestamp
            FROM
              compute_googleapis_com_Instance
            WHERE
              resource.location LIKE \"%asia%\""
         }' \
     https://cloudasset.googleapis.com/v1/SCOPE:queryAssets

Provide the following values:

SCOPE: A scope can be a project, a folder, or an organization.

The allowed values are:
- projects/PROJECT_ID
- projects/PROJECT_NUMBER
  How to find a Google Cloud project number
  Console
  
  To find a Google Cloud project number, complete the following steps:
  
  Go to the Dashboard page in the Google Cloud console.
  
  Go to Dashboard
  
  Click the switcher box in the menu bar.
  
  Select your organization from the Select from box, and then search for your project name.
  
  Click the project name to switch to that project. The project number is shown in the Project info card.
  
  gcloud CLI
  
  You can retrieve a Google Cloud project number with the following command:
  
  gcloud projects describe PROJECT_ID --format="value(projectNumber)"
- folders/FOLDER_ID
  How to find a Google Cloud folder ID
  Console
  
  To find a Google Cloud folder ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Search for your folder name. The folder ID is shown next to the folder name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
  
  gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
  
  Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.
  
  To get the ID of a folder within another folder, list the subfolders:
  
  gcloud resource-manager folders list --folder=FOLDER_ID
- organizations/ORGANIZATION_ID
  How to find a Google Cloud organization ID
  Console
  
  To find a Google Cloud organization ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Click the All tab. The organization ID is shown next to the organization name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud organization ID with the following command:
  
  gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

Query to identify every publicly accessible Cloud Storage bucket

gcloud

Projects

gcloud asset query \
    --project=PROJECT_ID \
    --statement="
      SELECT
        name
      FROM
        IAM_POLICY
      CROSS JOIN
        UNNEST(iamPolicy.bindings) AS binding
      WHERE
        ('allUsers' IN UNNEST(binding.members)
        OR 'allAuthenticatedUsers' IN UNNEST(binding.members))
        AND assetType = 'storage.googleapis.com/Bucket'"

Provide the following values:

PROJECT_ID: The ID of the project whose metadata you want to query.

Folders

gcloud asset query \
    --folder=FOLDER_ID \
    --statement="
      SELECT
        name
      FROM
        IAM_POLICY
      CROSS JOIN
        UNNEST(iamPolicy.bindings) AS binding
      WHERE
        ('allUsers' IN UNNEST(binding.members)
        OR 'allAuthenticatedUsers' IN UNNEST(binding.members))
        AND assetType = 'storage.googleapis.com/Bucket'"

Provide the following values:

FOLDER_ID: The ID of the folder whose metadata you want to query.
How to find a Google Cloud folder ID
Console

To find a Google Cloud folder ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI

You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:

gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"

Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.

To get the ID of a folder within another folder, list the subfolders:

gcloud resource-manager folders list --folder=FOLDER_ID

Organizations

gcloud asset query \
    --organization=ORGANIZATION_ID \
    --statement="
      SELECT
        name
      FROM
        IAM_POLICY
      CROSS JOIN
        UNNEST(iamPolicy.bindings) AS binding
      WHERE
        ('allUsers' IN UNNEST(binding.members)
        OR 'allAuthenticatedUsers' IN UNNEST(binding.members))
        AND assetType = 'storage.googleapis.com/Bucket'"

Provide the following values:

ORGANIZATION_ID: The ID of the organization whose metadata you want to query.
How to find a Google Cloud organization ID
Console

To find a Google Cloud organization ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI

You can retrieve a Google Cloud organization ID with the following command:

gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

REST

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json" \
     -d '{
          "statement": "
            SELECT
              name
            FROM
              IAM_POLICY
            CROSS JOIN
              UNNEST(iamPolicy.bindings) AS binding
            WHERE
              (\"allUsers\" IN UNNEST(binding.members)
              OR \"allAuthenticatedUsers\" IN UNNEST(binding.members))
              AND assetType = \"storage.googleapis.com/Bucket\""
         }' \
     https://cloudasset.googleapis.com/v1/SCOPE:queryAssets

Provide the following values:

SCOPE: A scope can be a project, a folder, or an organization.

The allowed values are:
- projects/PROJECT_ID
- projects/PROJECT_NUMBER
  How to find a Google Cloud project number
  Console
  
  To find a Google Cloud project number, complete the following steps:
  
  Go to the Dashboard page in the Google Cloud console.
  
  Go to Dashboard
  
  Click the switcher box in the menu bar.
  
  Select your organization from the Select from box, and then search for your project name.
  
  Click the project name to switch to that project. The project number is shown in the Project info card.
  
  gcloud CLI
  
  You can retrieve a Google Cloud project number with the following command:
  
  gcloud projects describe PROJECT_ID --format="value(projectNumber)"
- folders/FOLDER_ID
  How to find a Google Cloud folder ID
  Console
  
  To find a Google Cloud folder ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Search for your folder name. The folder ID is shown next to the folder name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
  
  gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
  
  Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.
  
  To get the ID of a folder within another folder, list the subfolders:
  
  gcloud resource-manager folders list --folder=FOLDER_ID
- organizations/ORGANIZATION_ID
  How to find a Google Cloud organization ID
  Console
  
  To find a Google Cloud organization ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Click the All tab. The organization ID is shown next to the organization name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud organization ID with the following command:
  
  gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

Query to find subnetworks that don't have attached VMs

gcloud

Projects

gcloud asset query \
    --project=PROJECT_ID \
    --statement="
      SELECT
        subnetwork_table.name
      FROM
        compute_googleapis_com_Subnetwork AS subnetwork_table
      LEFT JOIN (
        SELECT
          interface.subnetwork AS subnetwork
        FROM
          compute_googleapis_com_Instance
        CROSS JOIN
          UNNEST(resource.DATA.networkInterfaces) AS interface) AS instance_table
      ON
        SUBSTR(subnetwork_table.name, 25) = SUBSTR(instance_table.subnetwork,38)
      WHERE
        instance_table.subnetwork IS NULL
        AND NOT subnetwork_table.name LIKE '%default%'"

Provide the following values:

PROJECT_ID: The ID of the project whose metadata you want to query.

Folders

gcloud asset query \
    --folder=FOLDER_ID \
    --statement="
      SELECT
        subnetwork_table.name
      FROM
        compute_googleapis_com_Subnetwork AS subnetwork_table
      LEFT JOIN (
        SELECT
          interface.subnetwork AS subnetwork
        FROM
          compute_googleapis_com_Instance
        CROSS JOIN
          UNNEST(resource.DATA.networkInterfaces) AS interface) AS instance_table
      ON
        SUBSTR(subnetwork_table.name, 25) = SUBSTR(instance_table.subnetwork,38)
      WHERE
        instance_table.subnetwork IS NULL
        AND NOT subnetwork_table.name LIKE '%default%'"

Provide the following values:

FOLDER_ID: The ID of the folder whose metadata you want to query.
How to find a Google Cloud folder ID
Console

To find a Google Cloud folder ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI

You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:

gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"

Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.

To get the ID of a folder within another folder, list the subfolders:

gcloud resource-manager folders list --folder=FOLDER_ID

Organizations

gcloud asset query \
    --organization=ORGANIZATION_ID \
    --statement="
      SELECT
        subnetwork_table.name
      FROM
        compute_googleapis_com_Subnetwork AS subnetwork_table
      LEFT JOIN (
        SELECT
          interface.subnetwork AS subnetwork
        FROM
          compute_googleapis_com_Instance
        CROSS JOIN
          UNNEST(resource.DATA.networkInterfaces) AS interface) AS instance_table
      ON
        SUBSTR(subnetwork_table.name, 25) = SUBSTR(instance_table.subnetwork,38)
      WHERE
        instance_table.subnetwork IS NULL
        AND NOT subnetwork_table.name LIKE '%default%'"

Provide the following values:

ORGANIZATION_ID: The ID of the organization whose metadata you want to query.
How to find a Google Cloud organization ID
Console

To find a Google Cloud organization ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI

You can retrieve a Google Cloud organization ID with the following command:

gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

REST

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json" \
     -d '{
          "statement": "
            SELECT
              subnetwork_table.name
            FROM
              compute_googleapis_com_Subnetwork AS subnetwork_table
            LEFT JOIN (
              SELECT
                interface.subnetwork AS subnetwork
              FROM
                compute_googleapis_com_Instance
              CROSS JOIN
                UNNEST(resource.DATA.networkInterfaces) AS interface) AS instance_table
            ON
              SUBSTR(subnetwork_table.name, 25) = SUBSTR(instance_table.subnetwork,38)
            WHERE
              instance_table.subnetwork IS NULL
              AND NOT subnetwork_table.name LIKE \"%default%\""
         }' \
     https://cloudasset.googleapis.com/v1/SCOPE:queryAssets

Provide the following values:

SCOPE: A scope can be a project, a folder, or an organization.

The allowed values are:
- projects/PROJECT_ID
- projects/PROJECT_NUMBER
  How to find a Google Cloud project number
  Console
  
  To find a Google Cloud project number, complete the following steps:
  
  Go to the Dashboard page in the Google Cloud console.
  
  Go to Dashboard
  
  Click the switcher box in the menu bar.
  
  Select your organization from the Select from box, and then search for your project name.
  
  Click the project name to switch to that project. The project number is shown in the Project info card.
  
  gcloud CLI
  
  You can retrieve a Google Cloud project number with the following command:
  
  gcloud projects describe PROJECT_ID --format="value(projectNumber)"
- folders/FOLDER_ID
  How to find a Google Cloud folder ID
  Console
  
  To find a Google Cloud folder ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Search for your folder name. The folder ID is shown next to the folder name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
  
  gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
  
  Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.
  
  To get the ID of a folder within another folder, list the subfolders:
  
  gcloud resource-manager folders list --folder=FOLDER_ID
- organizations/ORGANIZATION_ID
  How to find a Google Cloud organization ID
  Console
  
  To find a Google Cloud organization ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Click the All tab. The organization ID is shown next to the organization name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud organization ID with the following command:
  
  gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

Query to find the number of BigQuery datasets in each project

gcloud

Projects

gcloud asset query \
    --project=PROJECT_ID \
    --statement="
      SELECT
        ancestor AS project,
        COUNT(*)
      FROM
        bigquery_googleapis_com_Dataset
      CROSS JOIN
        UNNEST (ancestors) AS ancestor
      WHERE
        ancestor LIKE '%project%'
      GROUP BY
        ancestor
      ORDER BY
        2 DESC"

Provide the following values:

PROJECT_ID: The ID of the project whose metadata you want to query.

Folders

gcloud asset query \
    --folder=FOLDER_ID \
    --statement="
      SELECT
        ancestor AS project,
        COUNT(*)
      FROM
        bigquery_googleapis_com_Dataset
      CROSS JOIN
        UNNEST (ancestors) AS ancestor
      WHERE
        ancestor LIKE '%project%'
      GROUP BY
        ancestor
      ORDER BY
        2 DESC"

Provide the following values:

FOLDER_ID: The ID of the folder whose metadata you want to query.
How to find a Google Cloud folder ID
Console

To find a Google Cloud folder ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI

You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:

gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"

Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.

To get the ID of a folder within another folder, list the subfolders:

gcloud resource-manager folders list --folder=FOLDER_ID

Organizations

gcloud asset query \
    --organization=ORGANIZATION_ID \
    --statement="
      SELECT
        ancestor AS project,
        COUNT(*)
      FROM
        bigquery_googleapis_com_Dataset
      CROSS JOIN
        UNNEST (ancestors) AS ancestor
      WHERE
        ancestor LIKE '%project%'
      GROUP BY
        ancestor
      ORDER BY
        2 DESC"

Provide the following values:

ORGANIZATION_ID: The ID of the organization whose metadata you want to query.
How to find a Google Cloud organization ID
Console

To find a Google Cloud organization ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI

You can retrieve a Google Cloud organization ID with the following command:

gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

REST

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json" \
     -d '{
          "statement": "
            SELECT
              ancestor AS project,
              COUNT(*)
            FROM
              bigquery_googleapis_com_Dataset
            CROSS JOIN
              UNNEST (ancestors) AS ancestor
            WHERE
              ancestor LIKE \"%project%\"
            GROUP BY
              ancestor
            ORDER BY
              2 DESC"
         }' \
     https://cloudasset.googleapis.com/v1/SCOPE:queryAssets

Provide the following values:

SCOPE: A scope can be a project, a folder, or an organization.

The allowed values are:
- projects/PROJECT_ID
- projects/PROJECT_NUMBER
  How to find a Google Cloud project number
  Console
  
  To find a Google Cloud project number, complete the following steps:
  
  Go to the Dashboard page in the Google Cloud console.
  
  Go to Dashboard
  
  Click the switcher box in the menu bar.
  
  Select your organization from the Select from box, and then search for your project name.
  
  Click the project name to switch to that project. The project number is shown in the Project info card.
  
  gcloud CLI
  
  You can retrieve a Google Cloud project number with the following command:
  
  gcloud projects describe PROJECT_ID --format="value(projectNumber)"
- folders/FOLDER_ID
  How to find a Google Cloud folder ID
  Console
  
  To find a Google Cloud folder ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Search for your folder name. The folder ID is shown next to the folder name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
  
  gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
  
  Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.
  
  To get the ID of a folder within another folder, list the subfolders:
  
  gcloud resource-manager folders list --folder=FOLDER_ID
- organizations/ORGANIZATION_ID
  How to find a Google Cloud organization ID
  Console
  
  To find a Google Cloud organization ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Click the All tab. The organization ID is shown next to the organization name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud organization ID with the following command:
  
  gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

Query to identify the VMs in a specific region at a specific timestamp

gcloud

Projects

gcloud asset query \
    --project=PROJECT_ID \
    --snapshot-time="SNAPSHOT_TIME" \
    --statement="
      SELECT
        name,
        resource.DATA.creationTimestamp
      FROM
        compute_googleapis_com_Instance
      WHERE
        resource.location LIKE '%asia%'"

Provide the following values:

PROJECT_ID: The ID of the project whose metadata you want to query.
SNAPSHOT_TIME: Optional. The time at which you want to take a snapshot of your assets. The value must be the current time or a time no more than 35 days in the past. When not provided, a snapshot is taken at the current time. For information on time formats, see gcloud topic datetimes.

Folders

gcloud asset query \
    --folder=FOLDER_ID \
    --snapshot-time="SNAPSHOT_TIME" \
    --statement="
      SELECT
        name,
        resource.DATA.creationTimestamp
      FROM
        compute_googleapis_com_Instance
      WHERE
        resource.location LIKE '%asia%'"

Provide the following values:

FOLDER_ID: The ID of the folder whose metadata you want to query.
How to find a Google Cloud folder ID
Console

To find a Google Cloud folder ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI

You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:

gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"

Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.

To get the ID of a folder within another folder, list the subfolders:

gcloud resource-manager folders list --folder=FOLDER_ID
SNAPSHOT_TIME: Optional. The time at which you want to take a snapshot of your assets. The value must be the current time or a time no more than 35 days in the past. When not provided, a snapshot is taken at the current time. For information on time formats, see gcloud topic datetimes.

Organizations

gcloud asset query \
    --organization=ORGANIZATION_ID \
    --snapshot-time="SNAPSHOT_TIME" \
    --statement="
      SELECT
        name,
        resource.DATA.creationTimestamp
      FROM
        compute_googleapis_com_Instance
      WHERE
        resource.location LIKE '%asia%'"

Provide the following values:

ORGANIZATION_ID: The ID of the organization whose metadata you want to query.
How to find a Google Cloud organization ID
Console

To find a Google Cloud organization ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI

You can retrieve a Google Cloud organization ID with the following command:

gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
SNAPSHOT_TIME: Optional. The time at which you want to take a snapshot of your assets. The value must be the current time or a time no more than 35 days in the past. When not provided, a snapshot is taken at the current time. For information on time formats, see gcloud topic datetimes.

REST

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json" \
     -d '{
          "statement": "
            SELECT
              name,
              resource.DATA.creationTimestamp
            FROM
              compute_googleapis_com_Instance
            WHERE
              resource.location LIKE \"%asia%\"",
          "readTime": "SNAPSHOT_TIME"
         }' \
     https://cloudasset.googleapis.com/v1/SCOPE:queryAssets

Provide the following values:

SNAPSHOT_TIME: Optional. The time at which you want to take a snapshot of your assets, in RFC 3339 format. The value must be the current time or a time no more than 35 days in the past. When not provided, a snapshot is taken at the current time.
SCOPE: A scope can be a project, a folder, or an organization.

The allowed values are:
- projects/PROJECT_ID
- projects/PROJECT_NUMBER
  How to find a Google Cloud project number
  Console
  
  To find a Google Cloud project number, complete the following steps:
  
  Go to the Dashboard page in the Google Cloud console.
  
  Go to Dashboard
  
  Click the switcher box in the menu bar.
  
  Select your organization from the Select from box, and then search for your project name.
  
  Click the project name to switch to that project. The project number is shown in the Project info card.
  
  gcloud CLI
  
  You can retrieve a Google Cloud project number with the following command:
  
  gcloud projects describe PROJECT_ID --format="value(projectNumber)"
- folders/FOLDER_ID
  How to find a Google Cloud folder ID
  Console
  
  To find a Google Cloud folder ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Search for your folder name. The folder ID is shown next to the folder name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
  
  gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
  
  Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.
  
  To get the ID of a folder within another folder, list the subfolders:
  
  gcloud resource-manager folders list --folder=FOLDER_ID
- organizations/ORGANIZATION_ID
  How to find a Google Cloud organization ID
  Console
  
  To find a Google Cloud organization ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Click the All tab. The organization ID is shown next to the organization name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud organization ID with the following command:
  
  gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

Query to identify the change history of VMs in a specific time range

gcloud

Projects

gcloud asset query \
    --project=PROJECT_ID \
    --start-time="START_TIME" \
    --end-time="END_TIME" \
    --statement="
      SELECT
        name,
        resource.DATA.creationTimestamp
      FROM
        compute_googleapis_com_Instance"

Provide the following values:

PROJECT_ID: The ID of the project whose assets you want to list.
START_TIME: Optional. The beginning of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. For information on time formats, see gcloud topic datetimes.
END_TIME: Optional. The finishing point of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. When not provided, the end time is assumed to be the current time. For information on time formats, see gcloud topic datetimes.

Folders

gcloud asset query \
    --folder=FOLDER_ID \
    --start-time="START_TIME" \
    --end-time="END_TIME" \
    --statement="
      SELECT
        name,
        resource.DATA.creationTimestamp
      FROM
        compute_googleapis_com_Instance"

Provide the following values:

FOLDER_ID: The ID of the folder whose assets you want to list.
How to find a Google Cloud folder ID
Console

To find a Google Cloud folder ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Search for your folder name. The folder ID is shown next to the folder name.
gcloud CLI

You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:

gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"

Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.

To get the ID of a folder within another folder, list the subfolders:

gcloud resource-manager folders list --folder=FOLDER_ID
START_TIME: Optional. The beginning of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. For information on time formats, see gcloud topic datetimes.
END_TIME: Optional. The finishing point of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. When not provided, the end time is assumed to be the current time. For information on time formats, see gcloud topic datetimes.

Organizations

gcloud asset query \
    --organization=ORGANIZATION_ID \
    --start-time="START_TIME" \
    --end-time="END_TIME" \
    --statement="
      SELECT
        name,
        resource.DATA.creationTimestamp
      FROM
        compute_googleapis_com_Instance"

Provide the following values:

ORGANIZATION_ID: The ID of the organization whose assets you want to list.
How to find a Google Cloud organization ID
Console

To find a Google Cloud organization ID, complete the following steps:

Go to the Google Cloud console.

Go to the Google Cloud console

Click the switcher box in the menu bar.

Click the Select from box, and then select your organization.

Click the All tab. The organization ID is shown next to the organization name.
gcloud CLI

You can retrieve a Google Cloud organization ID with the following command:

gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"
START_TIME: Optional. The beginning of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. For information on time formats, see gcloud topic datetimes.
END_TIME: Optional. The finishing point of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. When not provided, the end time is assumed to be the current time. For information on time formats, see gcloud topic datetimes.

REST

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json" \
     -d '{
          "statement": "
            SELECT
              name,
              resource.DATA.creationTimestamp
            FROM
              compute_googleapis_com_Instance",
          "readTimeWindow": {
            "startTime": "START_TIME",
            "endTime": "END_TIME"
          }
         }' \
     https://cloudasset.googleapis.com/v1/SCOPE:queryAssets

Provide the following values:

START_TIME: Optional. The beginning of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. For information on time formats, see gcloud topic datetimes.
END_TIME: Optional. The finishing point of the time range. The maximum time range is 7 days. The value must be the current time or a time no more than 35 days in the past. When not provided, the end time is assumed to be the current time. For information on time formats, see gcloud topic datetimes.
SCOPE: A scope can be a project, a folder, or an organization.

The allowed values are:
- projects/PROJECT_ID
- projects/PROJECT_NUMBER
  How to find a Google Cloud project number
  Console
  
  To find a Google Cloud project number, complete the following steps:
  
  Go to the Dashboard page in the Google Cloud console.
  
  Go to Dashboard
  
  Click the switcher box in the menu bar.
  
  Select your organization from the Select from box, and then search for your project name.
  
  Click the project name to switch to that project. The project number is shown in the Project info card.
  
  gcloud CLI
  
  You can retrieve a Google Cloud project number with the following command:
  
  gcloud projects describe PROJECT_ID --format="value(projectNumber)"
- folders/FOLDER_ID
  How to find a Google Cloud folder ID
  Console
  
  To find a Google Cloud folder ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Search for your folder name. The folder ID is shown next to the folder name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud folder ID that's located at the organization level with the following command:
  
  gcloud resource-manager folders list \ --organization=$(gcloud organizations describe ORGANIZATION_NAME \ --format="value(name.segment(1))") \ --filter='"DISPLAY_NAME":"TOP_LEVEL_FOLDER_NAME"' \ --format="value(ID)"
  
  Where TOP_LEVEL_FOLDER_NAME can be a full or partial string match. Remove the --format option to see further information about the found folders.
  
  To get the ID of a folder within another folder, list the subfolders:
  
  gcloud resource-manager folders list --folder=FOLDER_ID
- organizations/ORGANIZATION_ID
  How to find a Google Cloud organization ID
  Console
  
  To find a Google Cloud organization ID, complete the following steps:
  
  Go to the Google Cloud console.
  
  Go to the Google Cloud console
  
  Click the switcher box in the menu bar.
  
  Click the Select from box, and then select your organization.
  
  Click the All tab. The organization ID is shown next to the organization name.
  
  gcloud CLI
  
  You can retrieve a Google Cloud organization ID with the following command:
  
  gcloud organizations describe ORGANIZATION_NAME --format="value(name.segment(1))"

Querying assets

Limitations

Before you begin

gcloud CLI

REST

Permissions

Format a query

Field value response format

Query in Google Cloud console

Console

Save query results

gcloud

Projects

Folders

Console

gcloud CLI

Organizations

Console

gcloud CLI

REST

Console

gcloud CLI

Console

gcloud CLI

Console

gcloud CLI

Sample queries

Query assets

gcloud

Projects

Folders

Console

gcloud CLI

Organizations

Console

gcloud CLI

REST

Console

gcloud CLI

Console

gcloud CLI

Console

gcloud CLI

Query resource standard metadata across resource types

gcloud

Projects

Folders

Console

gcloud CLI

Organizations

Console

gcloud CLI

REST

Console

gcloud CLI

Console

gcloud CLI

Console

gcloud CLI

Fetching a response asynchronously by job reference

gcloud

Projects

Folders

Console

gcloud CLI

Organizations

Console

gcloud CLI

REST

Console

gcloud CLI

Console

gcloud CLI

Console

gcloud CLI

Fetching the next page of results for paginated requests with the REST API

Console

gcloud CLI

Console

gcloud CLI