Project has Cloud Asset Inventory API enabled

Check ID: iam_cloud_asset_inventory_enabled
Provider: GCP
Service: iam
Severity: HIGH
Categories: forensics-ready
Resource type: serviceusage.googleapis.com/Service

What this check verifies

Project service usage includes the Cloud Asset Inventory API (cloudasset.googleapis.com), enabling resource and IAM policy inventory with time-series metadata and change history.

Risk

Without Cloud Asset Inventory, gaps in asset and IAM visibility hinder detection of drift and unauthorized changes, weakening access control integrity and risking data confidentiality. Shadow assets and silent privilege escalation can persist, delaying incident response.

Recommendation

Enable Cloud Asset Inventory across all projects and, if applicable, at the organization level to maintain authoritative asset and IAM histories. Centralize analysis, retain records per policy, and use the data to enforce least privilege and defense in depth.

Remediation

CLI
Terraform
Dashboard steps

gcloud services enable cloudasset.googleapis.com —project <PROJECT_ID>

resource "google_project_service" "<example_resource_name>" {
  project = "<example_project_id>"
  service = "cloudasset.googleapis.com" # Enables Cloud Asset Inventory API to pass the check
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_cloud_asset_inventory_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

GCP project has Cloud Audit Logs enabled No project-level Service Account User or Token Creator roles

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires