gcp

Credentials, projects and scope for the GCP collectors.

Keys

Key	Type	Default	Description
project_ids	list	[]	List of project IDs to scan
organization_id	null	null	Organization to list from. Needed for the folder and project hierarchy.
credentials_file	null	null	Path to a service account key file. Leave null to use Application Default Credentials.
impersonate_service_account	null	null	e.g. scanner@my-project.iam.gserviceaccount.com
collection_scope	str	auto	auto: one Cloud Asset Inventory listing at organizations/ when organization_id is set (project_ids then filter it), else one per project. organization / project force either mode.
iam_policies	bool	true	Map IAM policy bindings (principal -> resource access)
map_hierarchy	bool	true	With organization_id: map the organization, folders and projects
org_policies	bool	true	Collect Organization Policy constraints.
vpc_service_controls	bool	true	Collect VPC Service Controls perimeters.
regions	list	[ALL]	GCP regions to scan. Use ['ALL'] for auto-discovery.
skip_asset_types	list[str]		Cloud Asset Inventory types left out of the map (high-churn objects) Not in the example file.
asset_page_size	int	1000	Not in the example file.
api_timeout_seconds	float	600.0	Not in the example file.
deep_sources	bool	True	Inventory mapping: also read what Cloud Asset Inventory does not return (Cloud DNS records, Security Command Center, Cloud Identity groups, deny and access boundary policies, PAM, audit-log configs, Monitoring, OS Config, Artifact Analysis, Backup and DR, Cloud Scheduler, Apigee, Infrastructure / Deployment Manager) Not in the example file.
rest_timeout_seconds	float	60.0	Not in the example file.
cloud_identity_customer_id	str | None	null	Cloud Identity customer ID (Cxxxxxxx) for group membership; found from the organization when unset Not in the example file.
max_dns_records_per_zone	int	5000	Not in the example file.
max_vulnerability_occurrences	int	5000	Artifact Analysis occurrences read per project Not in the example file.
max_groups	int	2000	Not in the example file.
max_group_members	int	5000	Not in the example file.
expand_predefined_roles	bool	True	Read the permissions of bound predefined roles (IAM Roles API) Not in the example file.
max_role_expansions	int	500	Not in the example file.
max_scheduler_locations	int	25	Not in the example file.
source_concurrency	int	4	Not in the example file.

In config.yaml

config.yaml (gcp)

gcp:
  project_ids: []          # List of project IDs to scan
  organization_id: null

  # Auth methods, tried in this order:
  # 1. credentials_file: a service account key JSON, or a workload identity
  #    federation (external_account) config JSON
  # 2. Application default credentials (GOOGLE_APPLICATION_CREDENTIALS,
  #    gcloud user credentials, or the GCE/GKE metadata server)
  # impersonate_service_account layers impersonation on top of either.
  credentials_file: null
  impersonate_service_account: null  # e.g. scanner@my-project.iam.gserviceaccount.com

  # Inventory mapping (`cloudg map`)
  collection_scope: auto   # auto: one org-wide listing when organization_id is set
  iam_policies: true       # IAM bindings -> principal / resource access edges
  map_hierarchy: true      # organization -> folders -> projects (needs organization_id)
  org_policies: true
  vpc_service_controls: true

  regions:
    - ALL                  # Auto-discover all GCP regions (default)
    # - us-central1        # Or specify individual regions
    # - europe-west1

Read from the annotated example config.yaml and the CloudGConfig models in cloudg/config.py.