google

Cloud services from Google.

Provider Summary

total services: 187
total resources: 2370

See also:
[SHOW] [DESCRIBE] [REGISTRY]

---

Installation

To pull the latest version of the google provider, run the following command:

REGISTRY PULL google;

To view previous provider versions or to pull a specific provider version, see here.

Authentication

The following authentication methods are supported:

• service_account
• interactive for running interactive queries from Cloud Shell or other machines where the user is authenticated using gcloud auth login

for more information on creating service accounts and key files, see Service accounts overview.

Service Account Environment Variable (default)

The following system environment variable is used by default:

• GOOGLE_CREDENTIALS - contents of the google service account key json file. This variable is sourced at runtime (from the local machine using export GOOGLE_CREDENTIALS=cat creds/my-sa-key.json for example or as a CI variable/secret).

This variable is sourced at runtime (from the local machine using export GOOGLE_CREDENTIALS=$(cat creds/my-sa-key.json) for example or as a CI variable/secret).

Specifying the service account key file location directly

You can specify the path to the service account key file without using the default environment variable by using the --auth flag of the stackql program. For example:

AUTH='{ "google": { "type": "service_account",  "credentialsfilepath": "creds/sa-key.json" }}'
stackql shell --auth="${AUTH}"

or using PowerShell:

$Auth = "{ 'google': { 'type': 'service_account',  'credentialsfilepath': 'creds/sa-key.json' }}"
stackql.exe shell --auth=$Auth

Interactive Authentication

When you are using Google Cloud Shell or on a machine where you have authenticated using gcloud auth login, you can then use the following authentication method:

AUTH='{ "google": { "type": "interactive" }}'
stackql shell --auth="${AUTH}"

or using PowerShell:

$Auth = "{ 'google': { 'type': 'interactive' }}"
stackql.exe shell --auth=$Auth

Compute inventory

All virtual machines in a project across every zone, with their state:

SELECT
  name,
  status,
  machineType,
  zone
FROM google.compute.instances
WHERE project = 'my-project';

Instance counts by status - a one-line capacity/spend sanity check:

SELECT status, count(*) AS instances
FROM google.compute.instances
WHERE project = 'my-project'
GROUP BY status;

Open firewall audit

Ingress rules open to the entire internet, and what they allow:

SELECT
  name,
  direction,
  sourceRanges,
  allowed
FROM google.compute.firewalls
WHERE project = 'my-project'
AND sourceRanges LIKE '%0.0.0.0/0%';

Storage bucket estate

Buckets by age, with location and storage class:

SELECT
  name,
  location,
  storageClass,
  timeCreated
FROM google.storage.buckets
WHERE project = 'my-project'
ORDER BY timeCreated DESC;

Service accounts

Every service account in the project - review this list regularly:

SELECT
  email,
  displayName,
  disabled
FROM google.iam.service_accounts
WHERE projectsId = 'my-project';

Enabled APIs

Which services are switched on in the project (filtered server-side):

SELECT
  json_extract(config, '$.name') AS api,
  state
FROM google.serviceusage.services
WHERE parent = 'my-project'
AND parentType = 'projects'
AND filter = 'state:ENABLED';

Project metadata

SELECT projectId, displayName, state
FROM google.cloudresourcemanager.projects
WHERE projectsId = 'my-project';

Provision, mutate and tear down

Mutations use the same SQL grammar - INSERT creates a resource, UPDATE patches it, EXEC invokes lifecycle methods and DELETE removes it. A bucket end to end:

-- create
INSERT INTO google.storage.buckets (project, data__name, data__location, data__storageClass)
SELECT 'my-project', 'my-unique-bucket-name', 'US', 'STANDARD';

-- label it
UPDATE google.storage.buckets
SET data__labels = '{"env": "dev", "provisioner": "stackql"}'
WHERE bucket = 'my-unique-bucket-name';

-- remove it
DELETE FROM google.storage.buckets
WHERE bucket = 'my-unique-bucket-name';

Lifecycle operations, like stopping and starting a VM, are invoked with EXEC:

EXEC google.compute.instances.stop
  @instance = 'my-vm', @project = 'my-project', @zone = 'us-central1-a';

EXEC google.compute.instances.start
  @instance = 'my-vm', @project = 'my-project', @zone = 'us-central1-a';

Services

accessapproval
accesscontextmanager
addressvalidation
advisorynotifications
agentidentity
agentidentitycredentials
agentregistry
aiplatform
airquality
alloydb
analyticshub
apigateway
apigee
apigeeregistry
apihub
apikeys
apim
appengine
apphub
areainsights
artifactregistry
assuredworkloads
backupdr
baremetalsolution
batch
beyondcorp
biglake
bigquery
bigqueryconnection
bigquerydatapolicy
bigquerydatatransfer
bigqueryreservation
bigtableadmin
billingbudgets
binaryauthorization
blockchainnodeengine
certificatemanager
ces
cloudasset
cloudbilling
cloudbuild
cloudcommerceprocurement
cloudcontrolspartner
clouddeploy
clouderrorreporting
cloudfunctions
cloudidentity
cloudkms
cloudlocationfinder
cloudnumberregistry
cloudprofiler
cloudresourcemanager
cloudscheduler
cloudshell
cloudsupport
cloudtasks
cloudtrace
composer
compute
config
connectors
contactcenteraiplatform
contactcenterinsights
container
containeranalysis
contentwarehouse
databasecenter
datacatalog
dataflow
dataform
datafusion
datalineage
datamigration
datapipelines
dataplex
dataproc
datastore
datastream
deploymentmanager
developerconnect
developerknowledge
dialogflow
discoveryengine
dlp
dns
documentai
domains
essentialcontacts
eventarc
file
firestore
geminicloudassist
gkebackup
gkehub

gkeonprem
health
healthcare
hypercomputecluster
iam
iamcredentials
iamv2
iamv2beta
iap
identitytoolkit
ids
jobs
kmsinventory
language
libraryagent
logging
looker
managedidentities
managedkafka
memcache
metastore
migrationcenter
ml
monitoring
netapp
networkconnectivity
networkmanagement
networksecurity
networkservices
notebooks
observability
ondemandscanning
oracledatabase
orgpolicy
osconfig
oslogin
parallelstore
parametermanager
places
policyanalyzer
policysimulator
policytroubleshooter
pollen
privateca
prod_tt_sasportal
publicca
pubsub
pubsublite
rapidmigrationassessment
recaptchaenterprise
recommendationengine
recommender
redis
retail
run
runtimeconfig
saasservicemgmt
sasportal
secretmanager
securesourcemanager
securitycenter
securityposture
serviceconsumermanagement
servicecontrol
servicedirectory
servicemanagement
servicenetworking
serviceusage
solar
spanner
speech
speechv2
sqladmin
storage
storagebatchoperations
storagetransfer
texttospeech
threatintelligence
tpu
trafficdirector
transcoder
translate
videointelligence
vision
vmmigration
vmwareengine
vpcaccess
webrisk
websecurityscanner
workflowexecutions
workflows
workloadmanager
workstations