> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Cloud Asset Inventory Is Enabled

### More Info:

The GCP resources and IAM policies captured by GCP Cloud Asset Inventory enables security analysis, resource change tracking, and compliance auditing.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS GCP
* CIS GCP 2.0.0
* Cloudanix Best Practice

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Ensure Cloud Asset Inventory Is Enabled" for GCP using GCP console, please follow the below steps:

        1. Open the GCP console and go to the Navigation menu.

        2. Select the "Security Command Center" option under the "Security" section.

        3. Click on the "Organization" tab and select your organization from the dropdown list.

        4. Click on the "Asset Inventory" tab and select the project for which you want to enable the Cloud Asset Inventory.

        5. Click on the "Enable" button to enable the Cloud Asset Inventory for the selected project.

        6. Review the configuration settings and click on the "Save" button to save the changes.

        7. Once the Cloud Asset Inventory is enabled, you can view the assets and their metadata in the Security Command Center dashboard.

        8. To ensure that the Cloud Asset Inventory is continuously enabled, you can set up a periodic review of the configuration settings.

        By following these steps, you can remediate the misconfiguration "Ensure Cloud Asset Inventory Is Enabled" for GCP using GCP console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Ensure Cloud Asset Inventory is enabled" for GCP using GCP CLI, you can follow the below steps:

        Step 1: Open the GCP Cloud Shell or any other terminal where GCP CLI is installed.

        Step 2: Run the following command to enable the Cloud Asset Inventory API:

        ```
        gcloud services enable cloudasset.googleapis.com
        ```

        Step 3: Next, run the following command to create a new asset inventory:

        ```
        gcloud asset create-feed <FEED_NAME> --content-type=resource --asset-names=<ASSET_NAME> --project=<PROJECT_ID>
        ```

        Note: Replace `<FEED_NAME>` with the desired name for the new feed, `<ASSET_NAME>` with the name of the asset you want to inventory, and `<PROJECT_ID>` with the ID of the project where the asset is located.

        Step 4: Run the following command to list all the feeds that have been created:

        ```
        gcloud asset feeds list --project=<PROJECT_ID>
        ```

        Step 5: Finally, run the following command to view the details of the new feed:

        ```
        gcloud asset feeds describe <FEED_NAME> --project=<PROJECT_ID>
        ```

        Note: Replace `<FEED_NAME>` with the name of the feed you created in Step 3, and `<PROJECT_ID>` with the ID of the project where the asset is located.

        By following these steps, you can ensure that the Cloud Asset Inventory is enabled for your GCP project.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "Ensure Cloud Asset Inventory Is Enabled" misconfiguration for GCP using Python, follow these steps:

        1. Install the necessary libraries:

        ```python theme={null}
        !pip install google-cloud-asset google-auth
        ```

        2. Set up authentication:

        ```python theme={null}
        from google.oauth2 import service_account

        credentials = service_account.Credentials.from_service_account_file(
            'path/to/your/credentials.json')
        ```

        3. Import the necessary libraries:

        ```python theme={null}
        from google.cloud import asset_v1
        from google.cloud.asset_v1 import enums
        ```

        4. Create a client instance:

        ```python theme={null}
        client = asset_v1.AssetServiceClient(credentials=credentials)
        ```

        5. Check if Cloud Asset Inventory is enabled:

        ```python theme={null}
        response = client.search_all_resources(
            scope='organizations/your_organization_id',
            asset_types=['cloudasset.googleapis.com/Asset'],
            query='resourceProperties.enableAssetDiscovery:true'
        )

        if len(response) > 0:
            print("Cloud Asset Inventory is already enabled.")
        else:
            print("Cloud Asset Inventory is not enabled.")
        ```

        6. If Cloud Asset Inventory is not enabled, enable it:

        ```python theme={null}
        operation = client.set_iam_policy(
            resource='organizations/your_organization_id',
            policy={
                'policy': {
                    'bindings': [
                        {
                            'role': 'roles/cloudasset.viewer',
                            'members': [
                                'user:your_email@example.com'
                            ]
                        }
                    ]
                }
            }
        )

        print("Cloud Asset Inventory has been enabled.")
        ```

        Note: Replace `your_organization_id` and `your_email@example.com` with the appropriate values for your GCP organization and email address. Also, make sure that the service account used for authentication has the necessary permissions to enable Cloud Asset Inventory.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Enable Cloud Asset Inventory (Cloud Asset API) for a project so assets can be
        # captured and exported for logging / analysis.

        resource "google_project_service" "cloud_asset_inventory" {
          project = "PROJECT_ID"            # Replace with your GCP project ID
          service = "cloudasset.googleapis.com"

          # Keep Cloud Asset Inventory enabled and prevent accidental disable on destroy
          disable_on_destroy = false
        }
        ```

        This does not force replacement of existing resources; it only enables the API on the project.

        To verify, `terraform plan` should show one new `google_project_service.cloud_asset_inventory` resource being created with `service = "cloudasset.googleapis.com"`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://cloud.google.com/asset-inventory/docs](https://cloud.google.com/asset-inventory/docs)