cai-example.yaml

#   Copyright 2021 Google LLC
#
#   Licensed under the Apache License, Version 2.0 (the "License");
#   you may not use this file except in compliance with the License.
#   You may obtain a copy of the License at
#
#       http://www.apache.org/licenses/LICENSE-2.0
#
#   Unless required by applicable law or agreed to in writing, software
#   distributed under the License is distributed on an "AS IS" BASIS,
#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#   See the License for the specific language governing permissions and
#   limitations under the License.
#
retryPeriod: 3 day ago

# Example for using the Cloud Asset Inventory processor, which looks up 
# all organizations service accounts and then queries their metrics to 
# produce a report.
#
# The processor requires Cloud Asset Viewer permission on the correct
# level.

processors:
  - cai
  - monitoring

cai:
  parent: organizations/1234567890
  # parent: projects/123456789
  assetTypes:
    - iam.googleapis.com/ServiceAccount
    # - iam.googleapis.com/ServiceAccountKey

  # See: https://cloud.google.com/asset-inventory/docs/reference/rest/v1/feeds#ContentType
  contentType: "RESOURCE"

  # readTime: "2021-09-13T14:14:23.045123456Z"

monitoring:
  timeSeries: "{{ assets['iam.googleapis.com/ServiceAccount']|json_encode }}"
  # Specify your monitoring metric scope project below, this only works if every project
  # is in its own metric scope.
  #project: |
  #  projects/{{ item.resource.data.projectId }}
  key: |
    {{ item.resource.data.email }}
  query: |
    fetch iam_service_account
    | metric iam.googleapis.com/service_account/authn_events_count
    | filter (resource.unique_id == '{{ item.resource.data.uniqueId }}')
    | group_by 14d, [.sum]
    | every 14d

outputs:
  - type: logger
    level: debug
    message: |
      Service Account Summary (use in last 14 days)

      {% for sa, ts in time_series.items() %}
        - {{ sa }}: {% if ts.int64s|first|length > 0 %}{{ ts.int64s|first|first }} times{% else %}not used{% endif %} 
      {% endfor %}