See llms.txt for all machine-readable content.

Back to Templates

Audit Google Cloud inventory and IAM changes with BigQuery and Google Sheets

Created by

Created by: Paolo Ronco || paoloronco
Paolo Ronco

Last update

Last update 2 days ago

Categories

Quick Overview

This workflow runs on a manual or daily schedule to inventory Google Cloud resources and IAM policy signals via Cloud Asset Inventory, store snapshots and change history in BigQuery, update a review-ready Google Sheets dashboard, and optionally email a digest with key changes and findings.

How it works

  1. Runs manually or every day at 03:15 and loads configuration such as GCP scope, BigQuery dataset location, Google Sheet ID, and email settings.
  2. Creates or reuses a BigQuery dataset and tables, and registers the scan as running in an n8n Data Table.
  3. Queries Google Cloud Asset Inventory to fetch all resources in the configured scope and normalizes the results into a canonical snapshot.
  4. Queries Cloud Asset Inventory IAM policy search to flag risky bindings (public access and basic roles) and evaluates governance rules like required labels and allowed locations.
  5. Writes the inventory snapshot and findings to BigQuery in batches, then compares the current snapshot to the previous completed run to record added/modified/removed assets and finalize the run status.
  6. Builds HTML and CSV exports and updates a multi-tab Google Sheets dashboard (Dashboard, Inventory, Findings, Changes, Scans) while preserving existing review checkboxes and notes.
  7. Sends an email digest via SMTP when configured to notify (baseline run, changes found, actionable findings, or IAM coverage issues), and records delivery status for the run.

Setup

  1. Create a copy of the provided Google Sheets dashboard template, keep the required tab names/headers intact, and share it with Editor access to the Google account/service account used by the workflow.
  2. Add Google API credentials with access to Cloud Asset Inventory (resource and IAM search), BigQuery (dataset/table creation and job execution), and Google Sheets (read/write), and enable the Cloud Asset, BigQuery, and Sheets APIs in your GCP project.
  3. In the Configuration step, set your scope (project/folder/org), billingProject, dataset, location, sheetId, emailTo, emailFrom, and adjust limits and governance rules (requiredLabels, labelAssetTypes, allowedLocations, reportChangeLimit, notifyEveryRun, and maxBytesBilled).
  4. Configure an SMTP credential for sending the optional digest email.
  5. Update the base n8n execution URL in the run initialization (used to build execution links) and optionally select an Error Workflow in n8n settings for failure handling.