gcp-credentials-audit

GCP Credentials Audit (READ-ONLY)

Overview

Walks every GCP project the caller can access, lists every API key and every user-managed service-account key, and classifies each by risk. Writes the result as JSON to the session directory. Does not mutate cloud state.

When to Use

• Triggered by the gcp-ironclad driver as Phase 1a.
• Or invoked standalone when you want only the audit, without applying any controls.

Inputs

• SESSION_DIR env var: path to the session directory created by the driver (e.g. /tmp/gcp-ironclad/2026-05-25T10-30-00Z/). If invoked standalone, default to /tmp/gcp-ironclad/standalone-$(date -u +%Y-%m-%dT%H-%M-%SZ)/.
• LOOKBACK_DAYS env var (optional): how many days back to look for last-used signal. Default 30.
• AUDIT_VERIFY_PARITY env var (optional): when 1, also runs the per-project loop over CAI-covered projects and diffs the inventories to prove parity (see "Parity mode"). Off by default.

Outputs

Writes ${SESSION_DIR}/audit.json matching output.schema.json in this skill's directory.

Risk classification

Class	Trigger
CRITICAL	API key with restrictions = NONE (fully unrestricted)
HIGH	API key restricted to a service the project has never used; SA with ≥3 user-managed keys; SA key older than 365 days
MEDIUM	API key created >180 days ago AND last-used >90 days ago; SA key older than 90 days
LOW	API key restricted to ≤1 service and used within the last 30 days
INFO	Google-managed keys (Firebase browser keys, default compute SAs, firebase-adminsdk-fbsvc@*)

Execution

Step A: Establish session directory

SESSION_DIR="${SESSION_DIR:-/tmp/gcp-ironclad/standalone-$(date -u +%Y-%m-%dT%H-%M-%SZ)}"
mkdir -p "${SESSION_DIR}/raw"
echo "SESSION_DIR=${SESSION_DIR}"

Step B: Discover projects (from driver scope or standalone), then derive the CAI query scopes and the number→id map.

# Project list (from driver scope, or discover standalone)
if [ -f "${SESSION_DIR}/scope.json" ]; then
  cp "${SESSION_DIR}/scope.json" "${SESSION_DIR}/scope.local.json"
else
  gcloud projects list --format=json > "${SESSION_DIR}/raw-projects.json"
  jq -n --slurpfile p "${SESSION_DIR}/raw-projects.json" '{projects:$p[0]}' \
    > "${SESSION_DIR}/scope.local.json"
fi
jq -r '.projects[].projectId' "${SESSION_DIR}/scope.local.json" > "${SESSION_DIR}/projects.txt"

# Derivations for the CAI fast path:
#  - projnum-to-id.json : project NUMBER -> projectId (CAI returns numbers)
#  - cai-scopes.txt     : distinct org/folder scopes to query
#  - uncovered.txt      : starts with parent-less (standalone) projects; the
#                         fast path appends projects whose scope query failed
jq '[.projects[] | select(.projectNumber) | {(.projectNumber): .projectId}] | add // {}' \
  "${SESSION_DIR}/scope.local.json" > "${SESSION_DIR}/projnum-to-id.json"
jq -r '.projects[] | select(.parent) | "\(.parent.type)s/\(.parent.id)"' \
  "${SESSION_DIR}/scope.local.json" | sort -u > "${SESSION_DIR}/cai-scopes.txt"
jq -r '.projects[] | select(.parent|not) | .projectId' \
  "${SESSION_DIR}/scope.local.json" > "${SESSION_DIR}/uncovered.txt"

echo "projects=$(wc -l < "${SESSION_DIR}/projects.txt") scopes=$(wc -l < "${SESSION_DIR}/cai-scopes.txt") standalone=$(wc -l < "${SESSION_DIR}/uncovered.txt")"