Audit Google Cloud IAM & Inventory Changes | BigQuery + Sheets

Audit Google Cloud IAM & resource inventory changes—then publish findings to BigQuery + Google Sheets

This n8n workflow automatically inventories Google Cloud resources and IAM policy signals, stores snapshots and change history in BigQuery, updates a review-ready Google Sheets dashboard, and can send an email digest with the most important changes and governance issues.

What this workflow does

• Runs manually or on a schedule (daily at 03:15) and loads configuration such as GCP scope, BigQuery dataset location, Google Sheet ID, and SMTP email settings.
• Creates or reuses BigQuery tables and registers the scan as running in an n8n Data Table.
• Fetches asset inventory from Google Cloud Asset Inventory for the configured scope, normalizing results into a canonical snapshot.
• Evaluates IAM policy signals via Cloud Asset Inventory IAM policy search to flag risky bindings (for example, public access and basic roles).
• Applies governance checks such as required labels and allowed locations.
• Persists snapshots and findings to BigQuery in batches, compares the current snapshot to the previous completed run, and records added/modified/removed assets and final run status.
• Exports and dashboards: generates HTML and CSV exports and updates a multi-tab Google Sheets dashboard (Dashboard, Inventory, Findings, Changes, Scans) while preserving existing review checkboxes and notes.
• Sends an email digest via SMTP when configured—covering baseline runs, detected changes, actionable findings, and IAM coverage issues—while recording delivery status for the run.

Use cases

• Spot unexpected resource additions or changes across a defined Google Cloud scope.
• Detect risky IAM bindings (public access / basic roles) and track governance compliance over time.
• Provide auditors and internal reviewers with a consistent Google Sheets report backed by BigQuery history.
• Automate daily Cloud Asset Inventory review with email notifications for key events.

Technical details

• Google Cloud Asset Inventory: asset inventory + IAM policy search
• BigQuery: dataset/table creation, batched snapshot and findings storage, run-to-run change comparison
• Google Sheets: multi-tab dashboard updates + HTML/CSV exports
• Email: SMTP digest delivery and delivery status tracking
• n8n nodes: if, set, code, wait, data table, email send