|
Core features and permissions
|
Resources:
Enabled APIs:
|
|
Agentless Vulnerability & Threat Detection
|
IAM & Service Accounts:
Cloud Run Services & Jobs:
-
cloud run v2 service (22)
-
cloud run v2 service iam policy (19)
-
cloud run service iam policy (3)
-
cloud run v2 job (4)
-
cloud run v2 job iam policy (4)
Cloud Scheduler:
Pub/Sub:
-
pubsub topic (4)
-
pubsub subscription (4)
-
pubsub topic iam policy (3)
-
pubsub topic iam member (3)
-
pubsub subscription iam policy (3)
Cloud Storage:
Secret Manager:
Workflows:
Networking:
-
compute network (1)
-
compute subnetwork (1)
-
compute firewall (1)
Firestore:
Logging:
Eventarc:
Virtual Machines:
Enabled APIs:
-
Cloud Run Admin API (run.googleapis.com)
-
Cloud Logging API (logging.googleapis.com)
-
IAM Service Account Credentials API (iamcredentials.googleapis.com)
-
Cloud Billing API (cloudbilling.googleapis.com)
-
Cloud Firestore API (firestore.googleapis.com)
-
Secret Manager API (secretmanager.googleapis.com)
-
Compute Engine API (compute.googleapis.com)
-
Cloud Scheduler API (cloudscheduler.googleapis.com)
-
Cloud Workflows API (workflows.googleapis.com)
-
Workflow Executions API (workflowexecutions.googleapis.com)
-
Eventarc API (eventarc.googleapis.com)
|
|
Real-Time Posture Monitoring
|
Resources:
Enabled APIs:
-
Cloud Logging API (Service: logging.googleapis.com)
-
Cloud Pub/Sub API (Service: pubsub.googleapis.com)
-
Cloud Storage API (Service: storage.googleapis.com)
-
Cloud Functions API (Service: cloudfunctions.googleapis.com)
-
Cloud Run Admin API (Service: run.googleapis.com)
-
Eventarc API (Service: eventarc.googleapis.com)
-
Cloud Build API (Service: cloudbuild.googleapis.com)
-
Artifact Registry API (Service: artifactregistry.googleapis.com)
-
Cloud Deployment Manager (Service: deploymentmanager.googleapis.com)
-
Identity and Access Management (IAM) API (Service: iam.googleapis.com)
Permissions:
Used in deployment:
-
resourcemanager.projects.get
-
iam.serviceAccounts.create
-
iam.serviceAccounts.delete
-
iam.serviceAccounts.get
-
iam.serviceAccounts.actAs
-
cloudfunctions.functions.create
-
cloudfunctions.functions.delete
-
cloudfunctions.functions.get
-
cloudfunctions.functions.update
-
run.services.get
-
run.services.setIamPolicy
-
eventarc.triggers.create
-
eventarc.triggers.delete
-
eventarc.triggers.get
-
artifactregistry.repositories.create
-
artifactregistry.repositories.get
-
pubsub.topics.create
-
pubsub.topics.delete
-
pubsub.topics.get
-
pubsub.topics.setIamPolicy
-
pubsub.topics.getIamPolicy
-
logging.sinks.create
-
logging.sinks.delete
-
logging.sinks.get
-
storage.buckets.create
-
storage.buckets.get
-
storage.buckets.delete
-
storage.objects.create
-
storage.objects.delete
-
storage.objects.get
-
deploymentmanager.deployments.get
-
deploymentmanager.deployments.delete
Roles used by the service account created:
-
roles/run.invoker
-
roles/pubsub.publisher
|
|
Data Security Posture
|
Phase: Deployment
IAM:
Networking:
-
google_compute_network (1)
-
google_compute_subnetwork (1)
-
google_compute_router (1)
-
google_compute_router_nat (1)
-
google_compute_firewall (4 to 5, conditional)
-
google_vpc_access_connector (1)
Storage:
-
google_storage_bucket (2)
-
google_storage_bucket_object (1)
-
google_storage_bucket_iam_member (1)
Compute:
Secret Manager:
-
google_secret_manager_secret (1)
-
google_secret_manager_secret_version (1)
-
google_secret_manager_secret_iam_member (1)
Monitoring:
-
google_monitoring_metric_descriptor (1)
-
google_monitoring_alert_policy (0 to 1, conditional)
-
google_monitoring_notification_channel (0 to 1, conditional)
Pub/Sub:
Cloud Functions:
Eventarc:
Cloud Scheduler:
Artifact Registry:
Cloud Run:
Logging:
Cloud Build:
Phase: Runtime
The following resources are created at runtime by application code and are not managed
by Terraform:
-
VM Instance (google_compute_instance): Created per scan job, terminated after heartbeat
timeout
-
Ephemeral External IP: Non-production environments only, released with VM deletion
-
Secret Manager Versions: New version per rotation cycle, keeps last 5 versions
-
Custom Metric Time Series Data: Written during VM lifecycle for monitoring
-
GCS Objects (Audit Logs): Delivered by GCP logging infrastructure
|