This guide describes how to use the Cloud Asset Inventory Analyze Move API to get adetailed report on warnings and blockers from a list of critical policiessystems prior to actually moving your project.

Enable APIs

Select or create a project as your API consumer project, enableCloud Asset API

This consumer project can be different from the project you plan to analyze andmigrate. Consumer project will be used to generate credentials to make APIrequest.

The next section describes the required roles and permissions that must begranted on the source project you plan to analyze.

Required permissions

To perform a project move analysis, you need a role that grants thecloudasset.assets.analyzeMove permission, such asCloud Asset Viewer orViewer.

To receive analysis on a service, you also need roles related to those services.These permissions include the following:

• If you want to view the inherited allow policies from the sourceproject's parent organization resource, you need theresourcemanager.organizations.getIamPolicy permission on thesource project's parent organization resource.

• If you want to view the inherited allow policies from the sourceproject's parent folder, you need theresourcemanager.folders.getIamPolicypermission on the source project's parent folder.

• If you want to view the allow policies on the project,you need theresourcemanager.projects.getIamPolicy permission on the sourceproject.

• If you want to view the inherited deny policies from the sourceproject's parent organization resource, you need theiam.denypolicies.getpermission on the source project's parent organization resource.

• If you want to view the organization policies that are inherited on thisproject, you need theorgpolicy.policy.get permission on the source project.

• If you want to view the Compute Engine firewall policies that are inheritedon this project, you need thecompute.organizations.setSecurityPolicypermission on the source folder or organization resource.

• If you want to view the inherited tags on this project, you need theresourcemanager.hierarchyNodes.listEffectiveTags permission on the source project or its ancestor nodes.

Perform the analysis

You can use the Google Cloud CLI or the API to analyze the migration of aresource from its current place in the resource hierarchy.

gcloud asset analyze-move --project=PROJECT_ID \  (--destination-folder=FOLDER_ID \    | --destination-organization=ORGANIZATION_ID)

gcloud asset analyze-move --project=PROJECT_ID \  --destination-folder=FOLDER_ID

gcloud asset analyze-move --project=PROJECT_ID \  --destination-organization=ORGANIZATION_ID

GET https://cloudasset.googleapis.com/v1/{resource=*/*}: \  analyzeMove?destinationParent=DESTINATION_NAME

Move analysis responses

The response you receive from the Move Analysis API is grouped by service name.Under each service is a list of warnings and blockers applicable to thisproject migration. Any blockers being returned by this analysis means that theproject migration will be blocked at run time if you proceed with the movebefore resolving them.

If there is an error returned by the Move Analysis API, it includes a standardgRPC code, as wellas a message that describes the reason for the failure of the Move AnalysisAPI to analyze the project.

The following table describes the error codes that could potentially be returnedby the Move Analysis API:

Example error message

The following example demonstrates the error code returned for a user that doesnot have thecloudasset.assets.analyzeMove permission on the project to be migrated:

{"error":{"code":403,"message":"Failed to fetch Project: projects/test-project-service-3 to perform              move analysis.","status":"PERMISSION_DENIED"}}

Some of the policy systems may fail to analyze the resource move. The followingexample demonstrates the error returned from the Hierarchical Firewall servicewhen the user does not havecompute.organizations.setSecurityPolicypermission on the project to be migrated:

{"moveAnalysis":[{"displayName":"name hidden","analysis":{"warnings":[{"detail":"details hidden"}]}},{"displayName":"name hidden","analysis":{"warnings":[{"detail":"details hidden"}]}},{"displayName":"Hierarchical Firewall","error":{"code":7,"message":"Failed to retrieve inherited security policies to perform                  analysis. Required 'compute.organizations.setSecurityPolicy'                  permission for {resource ID}"}}]}

What's next

The Move Analysis API provides details that help mitigate blockers and otherissues when moving a project from one organization resource to another. For moreinformation about migrating projects between organization resources, seeMigrating projects.