Table: gcp_project - Query Google Cloud Platform Projects using SQL
A Google Cloud Platform Project acts as an organizational unit within GCP where resources are allocated. It is used to group resources that belong to the same logical application or business unit. Each project is linked to a billing account and can have users, roles, and permissions assigned to it.
Table Usage Guide
The gcp_project
table provides insights into Projects within Google Cloud Platform. As a DevOps engineer, explore project-specific details through this table, including ID, name, labels, and lifecycle state. Utilize it to uncover information about projects, such as their associated resources, user roles, permissions, and billing details.
Examples
Basic info
Explore which Google Cloud Platform projects are active, by looking at their lifecycle state and creation time. This can help you manage resources effectively and keep track of ongoing projects.
select name, project_id, project_number, lifecycle_state, create_timefrom gcp_project;
select name, project_id, project_number, lifecycle_state, create_timefrom gcp_project;
Get access approval settings for all projects
Explore the access approval settings across your various projects. This can help you understand and manage permissions and approvals more effectively.
select name, jsonb_pretty(access_approval_settings) as access_approval_settingsfrom gcp_project;
select name, access_approval_settingsfrom gcp_project;
Get parent and organization ID for all projects
Get the parent resource and organization ID across your various projects.
select project_id, parent ->> 'id' as parent_id, parent ->> 'type' as parent_type, case when jsonb_array_length(ancestors) > 1 then ancestors -> -1 -> 'resourceId' ->> 'id' else null end as organization_idfrom gcp_project;
select project_id, parent ->> 'id' as parent_id, parent ->> 'type' as parent_type, case when json_array_length(ancestors) > 1 then ancestors -> -1 -> 'resourceId' ->> 'id' else null end as organization_idfrom gcp_project;
Query examples
- compute_disk_by_project
- compute_disk_encryption_table
- compute_disk_storage_by_project
- compute_instance_by_project
- compute_network_by_project
- kms_key_age_table
- kms_key_by_project
- kubernetes_cluster_by_project
- project_count
- project_table
- service_account_key_age_table
- sql_database_instance_by_project
- storage_bucket_age_table
- storage_bucket_by_project
Control examples
- All Controls > Project > Ensure 'Access Approval' is 'Enabled'
- CFT Scorecard v1 > Limit the number of App Engine application versions simultaneously running or installed
- CIS v1.2.0 > 1 Identity and Access Management > 1.12 Ensure API keys are not created for a project
- CIS v1.2.0 > 1 Identity and Access Management > 1.2 Ensure that multi-factor authentication is enabled for all non-service accounts
- CIS v1.2.0 > 1 Identity and Access Management > 1.3 Ensure that Security Key Enforcement is enabled for all admin accounts
- CIS v1.2.0 > 2 Logging and Monitoring > 2.10 Ensure that the log metric filter and alerts exist for Cloud Storage IAM permission changes
- CIS v1.2.0 > 2 Logging and Monitoring > 2.11 Ensure that the log metric filter and alerts exist for SQL instance configuration changes
- CIS v1.2.0 > 2 Logging and Monitoring > 2.2 Ensure that sinks are configured for all log entries
- CIS v1.2.0 > 2 Logging and Monitoring > 2.4 Ensure log metric filter and alerts exist for project ownership assignments/changes
- CIS v1.2.0 > 2 Logging and Monitoring > 2.5 Ensure that the log metric filter and alerts exist for Audit Configuration changes
- CIS v1.2.0 > 2 Logging and Monitoring > 2.6 Ensure that the log metric filter and alerts exist for Custom Role changes
- CIS v1.2.0 > 2 Logging and Monitoring > 2.7 Ensure that the log metric filter and alerts exist for VPC Network Firewall rule changes
- CIS v1.2.0 > 2 Logging and Monitoring > 2.8 Ensure that the log metric filter and alerts exist for VPC network route changes
- CIS v1.2.0 > 2 Logging and Monitoring > 2.9 Ensure that the log metric filter and alerts exist for VPC network changes
- CIS v1.2.0 > 4 Virtual Machines > 4.10 Ensure that App Engine applications enforce HTTPS connections
- CIS v1.2.0 > 6 Cloud SQL Database Services > 6.1 MySQL Database > 6.1.1 Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges
- CIS v1.2.0 > 6 Cloud SQL Database Services > 6.2 PostgreSQL Database > 6.2.13 Ensure that the 'log_min_messages' database flag for Cloud SQL PostgreSQL instance is set appropriately
- CIS v1.2.0 > 6 Cloud SQL Database Services > 6.2 PostgreSQL Database > 6.2.2 Ensure 'log_error_verbosity' database flag for Cloud SQL PostgreSQL instance is set to 'DEFAULT' or stricter
- CIS v1.2.0 > 6 Cloud SQL Database Services > 6.2 PostgreSQL Database > 6.2.7 Ensure 'log_statement' database flag for Cloud SQL PostgreSQL instance is set appropriately
- CIS v1.3.0 > 1 Identity and Access Management > 1.12 Ensure API keys are not created for a project
- CIS v1.3.0 > 1 Identity and Access Management > 1.18 Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager
- CIS v1.3.0 > 1 Identity and Access Management > 1.2 Ensure that multi-factor authentication is enabled for all non-service accounts
- CIS v1.3.0 > 1 Identity and Access Management > 1.3 Ensure that Security Key Enforcement is enabled for all admin accounts
- CIS v1.3.0 > 2 Logging and Monitoring > 2.10 Ensure that the log metric filter and alerts exist for Cloud Storage IAM permission changes
- CIS v1.3.0 > 2 Logging and Monitoring > 2.11 Ensure that the log metric filter and alerts exist for SQL instance configuration changes
- CIS v1.3.0 > 2 Logging and Monitoring > 2.14 Ensure 'Access Transparency' is 'Enabled'
- CIS v1.3.0 > 2 Logging and Monitoring > 2.15 Ensure 'Access Approval' is 'Enabled'
- CIS v1.3.0 > 2 Logging and Monitoring > 2.2 Ensure that sinks are configured for all log entries
- CIS v1.3.0 > 2 Logging and Monitoring > 2.4 Ensure log metric filter and alerts exist for project ownership assignments/changes
- CIS v1.3.0 > 2 Logging and Monitoring > 2.5 Ensure that the log metric filter and alerts exist for Audit Configuration changes
- CIS v1.3.0 > 2 Logging and Monitoring > 2.6 Ensure that the log metric filter and alerts exist for Custom Role changes
- CIS v1.3.0 > 2 Logging and Monitoring > 2.7 Ensure that the log metric filter and alerts exist for VPC Network Firewall rule changes
- CIS v1.3.0 > 2 Logging and Monitoring > 2.8 Ensure that the log metric filter and alerts exist for VPC network route changes
- CIS v1.3.0 > 2 Logging and Monitoring > 2.9 Ensure that the log metric filter and alerts exist for VPC network changes
- CIS v1.3.0 > 4 Virtual Machines > 4.10 Ensure that App Engine applications enforce HTTPS connections
- CIS v1.3.0 > 4 Virtual Machines > 4.12 Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Projects
- CIS v1.3.0 > 6 Cloud SQL Database Services > 6.1 MySQL Database > 6.1.1 Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges
- CIS v1.3.0 > 6 Cloud SQL Database Services > 6.2 PostgreSQL Database > 6.2.1 Ensure 'log_error_verbosity' database flag for Cloud SQL PostgreSQL instance is set to 'DEFAULT' or stricter
- CIS v1.3.0 > 6 Cloud SQL Database Services > 6.2 PostgreSQL Database > 6.2.4 Ensure 'log_statement' database flag for Cloud SQL PostgreSQL instance is set appropriately
- CIS v1.3.0 > 6 Cloud SQL Database Services > 6.2 PostgreSQL Database > 6.2.6 Ensure that the 'log_min_messages' database flag for Cloud SQL PostgreSQL instance is set appropriately
- CIS v2.0.0 > 1 Identity and Access Management > 1.12 Ensure API Keys Only Exist for Active Services
- CIS v2.0.0 > 1 Identity and Access Management > 1.18 Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager
- CIS v2.0.0 > 1 Identity and Access Management > 1.2 Ensure that multi-factor authentication is enabled for all non-service accounts
- CIS v2.0.0 > 1 Identity and Access Management > 1.3 Ensure that Security Key Enforcement is enabled for all admin accounts
- CIS v2.0.0 > 2 Logging and Monitoring > 2.10 Ensure that the log metric filter and alerts exist for Cloud Storage IAM permission changes
- CIS v2.0.0 > 2 Logging and Monitoring > 2.11 Ensure that the log metric filter and alerts exist for SQL instance configuration changes
- CIS v2.0.0 > 2 Logging and Monitoring > 2.14 Ensure 'Access Transparency' is 'Enabled'
- CIS v2.0.0 > 2 Logging and Monitoring > 2.15 Ensure 'Access Approval' is 'Enabled'
- CIS v2.0.0 > 2 Logging and Monitoring > 2.2 Ensure that sinks are configured for all log entries
- CIS v2.0.0 > 2 Logging and Monitoring > 2.4 Ensure log metric filter and alerts exist for project ownership assignments/changes
- CIS v2.0.0 > 2 Logging and Monitoring > 2.5 Ensure that the log metric filter and alerts exist for Audit Configuration changes
- CIS v2.0.0 > 2 Logging and Monitoring > 2.6 Ensure that the log metric filter and alerts exist for Custom Role changes
- CIS v2.0.0 > 2 Logging and Monitoring > 2.7 Ensure that the log metric filter and alerts exist for VPC Network Firewall rule changes
- CIS v2.0.0 > 2 Logging and Monitoring > 2.8 Ensure that the log metric filter and alerts exist for VPC network route changes
- CIS v2.0.0 > 2 Logging and Monitoring > 2.9 Ensure that the log metric filter and alerts exist for VPC network changes
- CIS v2.0.0 > 4 Virtual Machines > 4.10 Ensure that App Engine applications enforce HTTPS connections
- CIS v2.0.0 > 4 Virtual Machines > 4.12 Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Projects
- CIS v2.0.0 > 6 Cloud SQL Database Services > 6.1 MySQL Database > 6.1.1 Ensure that a MySQL database instance does not allow anyone to connect with administrative privileges
- CIS v3.0.0 > 1 Identity and Access Management > 1.12 Ensure API Keys Only Exist for Active Services
- CIS v3.0.0 > 1 Identity and Access Management > 1.17 Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager
- CIS v3.0.0 > 1 Identity and Access Management > 1.2 Ensure that Multi-Factor Authentication is 'Enabled' for All Non-Service Accounts
- CIS v3.0.0 > 1 Identity and Access Management > 1.3 Ensure that Security Key Enforcement is Enabled for All Admin Accounts
- CIS v3.0.0 > 2 Logging and Monitoring > 2.10 Ensure That the Log Metric Filter and Alerts Exist for Cloud Storage IAM Permission Changes
- CIS v3.0.0 > 2 Logging and Monitoring > 2.11 Ensure That the Log Metric Filter and Alerts Exist for SQL Instance Configuration Changes
- CIS v3.0.0 > 2 Logging and Monitoring > 2.14 Ensure 'Access Transparency' is 'Enabled'
- CIS v3.0.0 > 2 Logging and Monitoring > 2.15 Ensure 'Access Approval' is 'Enabled'
- CIS v3.0.0 > 2 Logging and Monitoring > 2.2 Ensure That Sinks Are Configured for All Log Entries
- CIS v3.0.0 > 2 Logging and Monitoring > 2.4 Ensure Log Metric Filter and Alerts Exist for Project Ownership Assignments/Changes
- CIS v3.0.0 > 2 Logging and Monitoring > 2.5 Ensure That the Log Metric Filter and Alerts Exist for Audit Configuration Changes
- CIS v3.0.0 > 2 Logging and Monitoring > 2.6 Ensure That the Log Metric Filter and Alerts Exist for Custom Role Changes
- CIS v3.0.0 > 2 Logging and Monitoring > 2.7 Ensure That the Log Metric Filter and Alerts Exist for VPC Network Firewall Rule Changes
- CIS v3.0.0 > 2 Logging and Monitoring > 2.8 Ensure That the Log Metric Filter and Alerts Exist for VPC Network Route Changes
- CIS v3.0.0 > 2 Logging and Monitoring > 2.9 Ensure That the Log Metric Filter and Alerts Exist for VPC Network Changes
- CIS v3.0.0 > 4 Virtual Machines > 4.10 Ensure That App Engine Applications Enforce HTTPS Connections
- CIS v3.0.0 > 4 Virtual Machines > 4.12 Ensure the Latest Operating System Updates Are Installed On Your Virtual Machines in All Project
- CIS v3.0.0 > 6 Cloud SQL Database Services > 6.1 MySQL Database > 6.1.1 Ensure That a MySQL Database Instance Does Not Allow Anyone To Connect With Administrative Privileges
- CIS v3.0.0 > 7 BigQuery > 7.4 Ensure all data in BigQuery has been classified
- Ensure log metric filter and alerts exist for project ownership assignments/changes
- Ensure that sinks are configured for all log entries
- Ensure that the log metric filter and alerts exist for Audit Configuration changes
- Ensure that the log metric filter and alerts exist for Cloud Storage IAM permission changes
- Ensure that the log metric filter and alerts exist for Custom Role changes
- Ensure that the log metric filter and alerts exist for SQL instance configuration changes
- Ensure that the log metric filter and alerts exist for VPC network changes
- Ensure that the log metric filter and alerts exist for VPC Network Firewall rule changes
- Ensure that the log metric filter and alerts exist for VPC network route changes
- Project should not have use api keys
Schema for gcp_project
Name | Type | Operators | Description |
---|---|---|---|
_ctx | jsonb | Steampipe context in JSON form. | |
access_approval_settings | jsonb | The access approval settings associated with this project. | |
akas | jsonb | Array of globally unique identifier strings (also known as) for the resource. | |
ancestors | jsonb | The ancestors of the project in the resource hierarchy, from bottom to top. | |
create_time | timestamp with time zone | Creation time of the project. | |
labels | jsonb | A list of labels attached to this project. | |
lifecycle_state | text | Specifies the project lifecycle state. | |
name | text | The name of the project. | |
parent | jsonb | An optional reference to a parent Resource. | |
project_id | text | An unique, user-assigned ID of the Project. | |
project_number | bigint | The number uniquely identifying the project. | |
self_link | text | Server-defined URL for the resource. | |
sp_connection_name | text | =, !=, ~~, ~~*, !~~, !~~* | Steampipe connection name. |
sp_ctx | jsonb | Steampipe context in JSON form. | |
tags | jsonb | A map of tags for the resource. | |
title | text | Title of the resource. |
Export
This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.
You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh
script:
/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- gcp
You can pass the configuration to the command with the --config
argument:
steampipe_export_gcp --config '<your_config>' gcp_project