cloud-security

Cloud Security — Cloud Security & Data Privacy Scan

Covers GCP infrastructure hardening, data privacy (PII/GDPR/CCPA), API security, container security, and compliance.

Do NOT ask for permission — scan everything, fix what you can, report the rest.

Step 0 — Detect cloud config

PROJECT_ROOT=$(git rev-parse --show-toplevel)
INSTRUCTION_FILE=$(for f in CLAUDE.md AGENTS.md .cursorrules; do [ -f "$PROJECT_ROOT/$f" ] && echo "$PROJECT_ROOT/$f" && break; done)
GCP_PROJECTS=$(grep -rh "GCP_PROJECT\|GOOGLE_CLOUD_PROJECT\|gcloud.*--project" ${INSTRUCTION_FILE:-/dev/null} .env.example terraform/ 2>/dev/null | grep -oE '[a-z][a-z0-9-]{4,28}' | sort -u | grep -v "^--" || true)
HAS_DOCKER=$(ls Dockerfile docker-compose.yml 2>/dev/null | head -1 || true)
HAS_TERRAFORM=$(ls terraform/*.tf infra/*.tf 2>/dev/null | head -1 || true)

Section 1 — GCP IAM & Access Control

For each GCP project detected:

for PROJECT in $GCP_PROJECTS; do
  echo "=== IAM: $PROJECT ==="
  gcloud projects get-iam-policy "$PROJECT" --format=json 2>/dev/null \
    | python3 -c "
import sys,json
p=json.load(sys.stdin)
bad=['roles/editor','roles/owner','roles/iam.securityAdmin','roles/storage.admin']
[print('[HIGH]',b['role'],m) for b in p.get('bindings',[]) for m in b['members'] if b['role'] in bad and ('serviceAccount' in m or 'allUsers' in m)]"
  gcloud iam service-accounts list --project="$PROJECT" --format="value(email)" 2>/dev/null \
    | while read SA; do
        n=$(gcloud iam service-accounts keys list --iam-account="$SA" --filter="keyType=USER_MANAGED" --format="value(KEY_ID)" 2>/dev/null | wc -l)
        [ "$n" -gt 0 ] && echo "[HIGH] $SA: $n user-managed key(s) — use Workload Identity instead"
      done
  gcloud projects get-iam-policy "$PROJECT" --format=json 2>/dev/null | grep -E "allUsers|allAuthenticatedUsers" && echo "[CRITICAL] Public IAM binding found" || true
done

Section 2 — GCP Network & Firewall

for PROJECT in $GCP_PROJECTS; do
  echo "=== Network: $PROJECT ==="
  gcloud compute firewall-rules list --project="$PROJECT" --format=json 2>/dev/null \
    | python3 -c "
import sys,json
sp={'22','3389','5432','6379','3306','27017','6443'}
[print('[CRITICAL] Firewall',r['name'],'port',p,'open to 0.0.0.0/0') for r in json.load(sys.stdin) if '0.0.0.0/0' in r.get('sourceRanges',[]) or '::/0' in r.get('sourceRanges',[]) for a in r.get('allowed',[]) for p in a.get('ports',[]) if str(p) in sp]"
  gcloud sql instances list --project="$PROJECT" --format=json 2>/dev/null \
    | python3 -c "
import sys,json
for i in json.load(sys.stdin):
  n,ip=i['name'],i.get('settings',{}).get('ipConfiguration',{})
  [print('[CRITICAL] Cloud SQL',n,'public IP open to',net['value']) if net.get('value') in ('0.0.0.0/0','::/0') else print('[MEDIUM] Cloud SQL',n,'public IP enabled') for net in ip.get('authorizedNetworks',[])] if ip.get('ipv4Enabled') else None
  print('[HIGH] Cloud SQL',n,'SSL not required') if not ip.get('requireSsl') and ip.get('sslMode','')!='ENCRYPTED_ONLY' else print('[PASS] Cloud SQL',n,'SSL enforced')
  print('[HIGH] Cloud SQL',n,'backups disabled') if not i.get('settings',{}).get('backupConfiguration',{}).get('enabled') else None"
done