Google Cloud の不要リソースを Asset Inventory で断捨離してみた。

from google.cloud import asset_v1, bigquery
import datetime

def export_assets_to_bigquery(project_id, dataset_id, table_prefix):
    # Initialisation
    bq_client = bigquery.Client()
    asset_client = asset_v1.AssetServiceClient()

    # BigQuery variables
    dataset_id = "check_resource"
    table_id = f'{table_prefix}_{datetime.datetime.utcnow().strftime("%d%m%Y_%H%M%S")}'
    bigquery_destination = f"projects/{project_id}/datasets/{dataset_id}"

    # Prepare the output configuration
    output_config = asset_v1.OutputConfig(
        bigquery_destination=asset_v1.BigQueryDestination(
            dataset=bigquery_destination,
            table=table_id,
            force=True
        )
    )

    # Prepare the request
    request = asset_v1.ExportAssetsRequest(
        parent=f"projects/{project_id}",
        content_type=asset_v1.ContentType.RESOURCE,
        output_config=output_config
    )

    try:
        operation = asset_client.export_assets(request=request)
        response = operation.result()
        print(f"Successfully exported assets to BigQuery table: {table_id}")
    except Exception as e:
        print(f"Failed to export assets: {e}")

project_id = "[PROJECT_ID]"
dataset_id = "check_resource"
table_prefix = "asset_inventory"

export_assets_to_bigquery(project_id, dataset_id, table_prefix)

gsutil rm -r gs://asia.artifacts.[PROJECT_ID].appspot.com

[
    {
      "name": "keep-last-3",
      "action": {"type": "Keep"},
      "mostRecentVersions": {
        "keepCount": 3
      }
    },
    {
      "name": "delete",
      "action": {"type": "Delete"},
      "condition": {
        "tagState": "any"
      }
    }
]

gcloud artifacts repositories set-cleanup-policies gcf-artifacts \
    --project=[PROJECT_ID] \
    --location=asia-northeast1 \
    --policy=cleanup_policy.json \
    --dry-run

$  gcloud artifacts repositories set-cleanup-policies gcf-artifacts \
    --project=[PROJECT_ID] \
    --location=asia-northeast1 \
    --policy=cleanup_policy.json \
    --no-dry-run
Updated repository [gcf-artifacts].
Dry run is disabled.
[
  {
    "action": {
      "type": "DELETE"
    },
    "condition": {
      "tagState": "ANY"
    },
    "name": "delete"
  },
  {
    "action": {
      "type": "KEEP"
    },
    "mostRecentVersions": {
      "keepCount": 3
    },
    "name": "keep-last-3"
  }
]

select
  name,
  replace(json_extract(resource.data, '$.description'), "\"", "") as description,
  replace(json_extract(resource.data, '$.displayName'), "\"", "") as displayName,
  replace(json_extract(resource.data, '$.email'), "\"", "") as email,
  update_time
from
  check_resource.asset_inventory_25082024_121942
where
  asset_type = 'iam.googleapis.com/ServiceAccount'
  and update_time < TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 360 DAY)
order by update_time

gcloud iam service-accounts delete \
    SA_NAME@PROJECT_ID.iam.gserviceaccount.com

select
  name,
  split(replace(json_extract(resource.data, '$.name'), "\"", ""), '/')[3] as sa_id,
  split(replace(json_extract(resource.data, '$.name'), "\"", ""), '/')[5] as key_id,
  update_time
from
  check_resource.asset_inventory_25082024_121942
where
  asset_type = 'iam.googleapis.com/ServiceAccountKey'
  and split(json_extract(resource.data, '$.name'), '/')[3] = 'temp-sa-rotation@cm-da-mikami-yuki-258308.iam.gserviceaccount.com'
order by update_time

gcloud iam service-accounts keys delete KEY_ID \
    --iam-account=temp-sa-rotation@PROJECT_ID.iam.gserviceaccount.com