Cloud Asset InventoryでGoogle Cloud環境のアセット情報を収集・分析・可視化する

$ tree -l
.
├── bigquery.tf
├── cloud_run_jobs.tf
├── cloud_scheduler.tf
├── enable_api.tf
├── outputs.tf
├── terraform.tfstate
├── terraform.tfstate.backup
├── terraform.tfvars.example
├── variables.tf
└── versions.tf

variable "project_id" {
  description = "Google Cloud Project ID"
  type        = string
}

variable "organization_id" {
  description = "Google Cloud Organization ID"
  type        = string
}

variable "region" {
  description = "Google Cloud Region"
  type        = string
  default     = "asia-northeast1"
}

variable "dataset_id" {
  description = "BigQuery Dataset ID for Asset Inventory"
  type        = string
  default     = "asset_inventory"
}

variable "table_id" {
  description = "BigQuery Table ID for Asset Inventory"
  type        = string
  default     = "resources"
}

variable "dataset_location" {
  description = "BigQuery Dataset Location"
  type        = string
  default     = "asia-northeast1"
}

variable "schedule" {
  description = "Cloud Scheduler cron schedule (default: daily at 9:00 AM JST)"
  type        = string
  default     = "0 9 * * *"
}

variable "time_zone" {
  description = "Time zone for Cloud Scheduler"
  type        = string
  default     = "Asia/Tokyo"
}

terraform {
  required_version = ">= 1.13"

  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 7.0"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

# Enable required APIs
resource "google_project_service" "services" {
  for_each = toset([
    "cloudasset.googleapis.com",
    "bigquery.googleapis.com",
    "run.googleapis.com",
    "cloudscheduler.googleapis.com",
  ])

  project = var.project_id
  service = each.value

  disable_on_destroy = false
}

# BigQuery Dataset
resource "google_bigquery_dataset" "asset_inventory" {
  dataset_id  = var.dataset_id
  project     = var.project_id
  location    = var.dataset_location
  description = "Dataset for Google Cloud Asset Inventory exports"

  labels = {
    environment = "production"
    managed_by  = "terraform"
  }

  depends_on = [google_project_service.services]
}

# Service Account for Asset Inventory Export
resource "google_service_account" "asset_exporter" {
  account_id   = "asset-inventory-exporter"
  display_name = "Asset Inventory Exporter Service Account"
  project      = var.project_id
  description  = "Service account for exporting asset inventory to BigQuery"
}

# Grant Cloud Asset Viewer role at organization level
resource "google_organization_iam_member" "asset_viewer" {
  org_id = var.organization_id
  role   = "roles/cloudasset.viewer"
  member = "serviceAccount:${google_service_account.asset_exporter.email}"
}

# Grant BigQuery Data Editor role
resource "google_bigquery_dataset_iam_member" "data_editor" {
  dataset_id = google_bigquery_dataset.asset_inventory.dataset_id
  role       = "roles/bigquery.dataEditor"
  member     = "serviceAccount:${google_service_account.asset_exporter.email}"
  project    = var.project_id
}

# Grant BigQuery Job User role
resource "google_project_iam_member" "bigquery_job_user" {
  project = var.project_id
  role    = "roles/bigquery.jobUser"
  member  = "serviceAccount:${google_service_account.asset_exporter.email}"
}

# Cloud Run Job for Asset Inventory Export
resource "google_cloud_run_v2_job" "asset_exporter" {
  name     = "asset-inventory-exporter"
  location = var.region
  project  = var.project_id

  template {
    template {
      service_account = google_service_account.asset_exporter.email

      containers {
        image = "gcr.io/google.com/cloudsdktool/google-cloud-cli:latest"

        command = ["/bin/bash"]
        args = [
          "-c",
          <<-EOT
            for content_type in resource iam-policy org-policy access-policy os-inventory
            do
              gcloud asset export \
                --organization=${var.organization_id} \
                --content-type=$${content_type} \
                --bigquery-table=projects/${var.project_id}/datasets/${var.dataset_id}/tables/$${content_type} \
                --output-bigquery-force
            done
          EOT
        ]

        resources {
          limits = {
            cpu    = "1"
            memory = "512Mi"
          }
        }
      }

      max_retries = 3
      timeout     = "3600s"
    }
  }

  depends_on = [
    google_project_service.services,
    google_organization_iam_member.asset_viewer,
    google_bigquery_dataset_iam_member.data_editor,
    google_project_iam_member.bigquery_job_user
  ]

  lifecycle {
    ignore_changes = [
      template[0].template[0].containers[0].image
    ]
  }
}

# Cloud Scheduler Job
resource "google_cloud_scheduler_job" "asset_export" {
  name             = "asset-inventory-export-schedule"
  description      = "Scheduled job to export asset inventory to BigQuery"
  schedule         = var.schedule
  time_zone        = var.time_zone
  region           = var.region
  project          = var.project_id
  attempt_deadline = "320s"

  retry_config {
    retry_count = 3
  }

  http_target {
    http_method = "POST"
    uri         = "https://${var.region}-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/${var.project_id}/jobs/${google_cloud_run_v2_job.asset_exporter.name}:run"

    oauth_token {
      service_account_email = google_service_account.scheduler.email
    }
  }

  depends_on = [
    google_project_service.services,
    google_cloud_run_v2_job_iam_member.invoker
  ]
}

# Service Account for Cloud Scheduler
resource "google_service_account" "scheduler" {
  account_id   = "asset-export-scheduler"
  display_name = "Asset Export Scheduler Service Account"
  project      = var.project_id
  description  = "Service account for Cloud Scheduler to invoke Cloud Run Job"
}

# Grant Cloud Run Invoker role to Scheduler Service Account
resource "google_cloud_run_v2_job_iam_member" "invoker" {
  project  = var.project_id
  location = var.region
  name     = google_cloud_run_v2_job.asset_exporter.name
  role     = "roles/run.invoker"
  member   = "serviceAccount:${google_service_account.scheduler.email}"
}

output "bigquery_dataset_id" {
  description = "BigQuery Dataset ID"
  value       = google_bigquery_dataset.asset_inventory.dataset_id
}

output "asset_exporter_service_account_email" {
  description = "Service Account email for Asset Exporter"
  value       = google_service_account.asset_exporter.email
}

output "scheduler_service_account_email" {
  description = "Service Account email for Cloud Scheduler"
  value       = google_service_account.scheduler.email
}

output "cloud_run_job_name" {
  description = "Cloud Run Job name"
  value       = google_cloud_run_v2_job.asset_exporter.name
}

output "cloud_run_job_url" {
  description = "Cloud Run Job URL"
  value       = "https://console.cloud.google.com/run/jobs/details/${var.region}/${google_cloud_run_v2_job.asset_exporter.name}"
}

output "cloud_scheduler_job_name" {
  description = "Cloud Scheduler Job name"
  value       = google_cloud_scheduler_job.asset_export.name
}

output "schedule" {
  description = "Cloud Scheduler cron schedule"
  value       = var.schedule
}

output "next_scheduled_run" {
  description = "Information about the schedule"
  value       = "Check Cloud Scheduler console for next scheduled run time"
}