[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-03。"],[],[],null,["# Asset inventory services for VMware Engine\n==========================================\n\nCloud Asset Inventory provides inventory services based on a time series database that\nenables you to search, export, and analyze asset metadata associated with the\nonboarded resources. Cloud Asset Inventory is a fully managed inventory service\nwhere you can control the access to Cloud Asset Inventory data down to each\nresource and policy type. This lets you benefit from the power of a centralized\ninventory, and also achieve least privilege when needed.\n\nKey VMware Engine resources or assets are available through the\nCloud Asset API and are also available using the Cloud Asset Inventory UI under\nIdentity and Access Management on your Google Cloud console. The Cloud Asset API resources include:\n\n- [PrivateCloud](/vmware-engine/docs/reference/rest/v1/projects.locations.privateClouds)\n- [Cluster](/vmware-engine/docs/reference/rest/v1/projects.locations.privateClouds.clusters)\n- [VMwareEngineNetwork](/vmware-engine/docs/reference/rest/v1/projects.locations.vmwareEngineNetworks)\n- [NetworkPeering](/vmware-engine/docs/reference/rest/v1/projects.locations.networkPeerings)\n- [PrivateConnection](/vmware-engine/docs/reference/rest/v1/projects.locations.privateConnections)\n- [NetworkPolicy](/vmware-engine/docs/reference/rest/v1/projects.locations.networkPolicies)\n- [ExternalAccessRule](/vmware-engine/docs/reference/rest/v1/projects.locations.networkPolicies.externalAccessRules)\n- [ExternalAddress](/vmware-engine/docs/reference/rest/v1/projects.locations.privateClouds.externalAddresses)\n\nFor these resources, the Cloud Asset Inventory UI and Cloud Asset API enable the\nfollowing features:\n\n- **Search and visibility:** Search asset metadata, including\n IAM policies associated with it by using a custom query\n language.\n\n - [SearchAllResources](/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllResources): Searches all Google Cloud resources within the specified scope, such as project, folder, or organization.\n - [SearchAllIamPolicies](/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllIamPolicies): Searches all IAM policies within the specified scope, such as project, folder, or organization.\n - [ListAssets](/asset-inventory/docs/listing-assets): View a paginated list of the assets at a given timestamp.\n - [QueryAssets](/asset-inventory/docs/reference/rest/v1/TopLevel/queryAssets): Issue a job that queries assets using an SQL statement compatible with BigQuery SQL.\n - These API also enable you to use the Global Search on the Google Cloud console to find VMware Engine resources. Use the global search bar to search for the name of any VMware Engine resource that's available through the Cloud Asset API. The resource displays in the list of results.\n\n To search VMware Engine resources or IAM policies\n using the Cloud Asset Inventory console, do the following:\n 1. Go to the **Asset Inventory** page in the Google Cloud console.\n\n [Go to Asset Inventory](https://console.cloud.google.com/iam-admin/asset-inventory/policies)\n 1. To set the scope of your search, open the Projects list box in the menu\n bar, and then select the organization, folder, or project to query.\n\n 2. Select the **Resource** or **IAM Policy** tab.\n\n 3. For **Filter results**, check the box next to the chosen filters.\n\n The resources or policies matching the query are listed in the **Result**\n table.\n\n To view the query as a Google Cloud CLI command, select **View query**.\n\n To export the results, select **Download CSV**.\n- **Monitoring and analysis:** You can export all asset metadata at a certain\n timestamp or export event change history during a specific timeframe.\n Further, you can also monitor asset changes by subscribing to real-time\n notifications.\n\n - [ExportAssets](/asset-inventory/docs/reference/rest/v1/TopLevel/exportAssets): Exports assets with time and resource types to a given Cloud Storage location or BigQuery table.\n - [BatchGetAssetsHistory](/asset-inventory/docs/reference/rest/v1/TopLevel/batchGetAssetsHistory): Batch gets the update history of assets that overlap a time window.\n - [Feed](/asset-inventory/docs/reference/rest/v1/feeds): An asset feed used to export asset updates to a destination. Set up Cloud Pub/Sub channels to get real-time updates on any asset config change, reduce the frequency of exports, and easily achieve continuous monitoring.\n\n To analyze which IAM policies have access to which\n Google Cloud resources using the Cloud Asset Inventory console, do the\n following:\n 1. In the Google Cloud console, go to the **Policy Analyzer**\n page.\n\n [Go to the Policy Analyzer page](https://console.cloud.google.com/iam-admin/analyzer)\n 2. In the **Analyze policies** section, find the pane labeled **Custom\n query** and click **Create custom query** in that pane.\n\n 3. In the **Select query scope** field, select the project, folder, or\n organization that you want to scope the query to.\n Policy Analyzer will analyze access for that project, folder,\n or organization, as well as any resources within that project, folder,\n or organization.\n\n 4. Choose the resource to check and the role or permission to check for:\n\n 1. In the **Parameter 1** field, select **Resource** from the drop-down menu.\n 2. In the **Resource** field, enter the full resource name of the resource that you want to analyze access for. If you don't know the full resource name, start typing the display name of the resource, then select the resource from the list of resources provided.\n 3. Click add **Add selector**.\n 4. In the **Parameter 2** field, select either **Role** or **Permission**.\n 5. In the **Select a role** or **Select a permission** field, select the role or permission that you want to check for.\n 6. Optional: To check for additional roles and permissions, continue adding **Role** and **Permission** selectors until all the roles and permissions that you want to check for are listed.\n 5. Optional: Click **Continue** , then select any\n [advanced options](/policy-intelligence/docs/analyze-iam-policies#options) that you want to enable for this query.\n\n 6. In the **Custom query** pane, click **Analyze \\\u003e Run\n query**. The report page shows the query parameters you entered, and a\n results table of all principals with the specified roles or permissions\n on the specified resource.\n\n\n Policy analysis queries in the Google Cloud console run for up to one minute. After\n one minute, the Google Cloud console stops the query and displays all available\n results. If the query didn't finish in that time, the Google Cloud console displays\n a banner indicating that the results are incomplete. To get more results\n for these queries,\n [export the\n results to BigQuery](/policy-intelligence/docs/policy-analyzer-write-to-bigquery).\n- **IAM policy analysis:** [Analyze policy APIs](/asset-inventory/docs/analyzing-iam-policy) to find\n out who has access to what.\n\n - [AnalyzeIamPolicy](/asset-inventory/docs/reference/rest/v1/TopLevel/analyzeIamPolicy): Analyzes IAM policies to answer which identities have what accesses on which resources.\n - [AnalyzeIamPolicyLongrunning](/asset-inventory/docs/reference/rest/v1/TopLevel/analyzeIamPolicyLongrunning): Analyzes IAM policies asynchronously to answer which identities have what accesses on which resources, and writes the analysis results to a Cloud Storage or a BigQuery destination.\n\nWhat's next\n-----------\n\n- Find the list of [resources available using Cloud Asset Inventory](/asset-inventory/docs/supported-asset-types) and search for VMware.\n- Learn more about what you can do with [Cloud Asset Inventory](/asset-inventory/docs/overview)."]]
