mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-24 13:01:56 +00:00
Rubén De la Torre Vico
41 lines
1.5 KiB
Plaintext
41 lines
1.5 KiB
Plaintext
---
|
||
title: 'Scanning a Specific GCP Organization'
|
||
---
|
||
|
||
By default, Prowler scans all Google Cloud projects accessible to the authenticated user.
|
||
|
||
To limit the scan to projects within a specific Google Cloud organization, use the `--organization-id` option with the GCP organization’s ID:
|
||
|
||
```console
|
||
prowler gcp --organization-id organization-id
|
||
```
|
||
|
||
<Warning>
|
||
Ensure the credentials used have one of the following roles bound **at the organization node** (not at a project): Cloud Asset Viewer (`roles/cloudasset.viewer`) or Cloud Asset Owner (`roles/cloudasset.owner`). The role must be bound directly on the organization so the Cloud Asset API can enumerate projects across the whole hierarchy.
|
||
|
||
```bash
|
||
gcloud organizations add-iam-policy-binding <organization-id> \
|
||
--member="serviceAccount:<service-account-email>" \
|
||
--role="roles/cloudasset.viewer"
|
||
```
|
||
|
||
The Cloud Asset API (`cloudasset.googleapis.com`) must also be enabled in the project that owns the credentials (the service account's host project, or the quota project for user credentials):
|
||
|
||
```bash
|
||
gcloud services enable cloudasset.googleapis.com --project <credentials-project-id>
|
||
```
|
||
|
||
</Warning>
|
||
<Note>
|
||
With this option, Prowler retrieves all projects under the specified Google Cloud organization, including those organized within folders and nested subfolders. This ensures full visibility across the entire organization’s hierarchy.
|
||
|
||
</Note>
|
||
<Note>
|
||
To obtain the Google Cloud organization ID, use:
|
||
|
||
```console
|
||
gcloud organizations list
|
||
```
|
||
|
||
</Note>
|