Skip to content

Commit 4dfb36e

Browse files
shiftcmdshiftcmd
committed
🍊 CitrusIO GCP Infrastructure Audit Tool
✨ Features: - Comprehensive GCP infrastructure auditing - Auto-discovery of all accessible projects - Detailed JSON reporting with timestamps - Security-focused design with credential protection - Organized output in audit_reports/ directory 🛠️ Components: - gcp_audit_script.py: Main auditing tool - gcp_rollback_script.py: Infrastructure rollback capabilities 🔒 Security: - .gitignore protects sensitive audit reports - Safe defaults (read-only operations) - Graceful error handling for permission issues - No credential storage or logging
0 parents  commit 4dfb36e

File tree

7 files changed

+1358
-0
lines changed

7 files changed

+1358
-0
lines changed

‎.gitignore‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# Sensitive files and credentials
2+
*.json
3+
*-key.json
4+
credentials.json
5+
service-account*.json
6+
7+
# Audit reports (contain sensitive infrastructure data)
8+
audit_reports/
9+
*.log
10+
11+
# Python
12+
__pycache__/
13+
*.py[cod]
14+
*$py.class
15+
*.so
16+
.Python
17+
build/
18+
develop-eggs/
19+
dist/
20+
downloads/
21+
eggs/
22+
.eggs/
23+
lib/
24+
lib64/
25+
parts/
26+
sdist/
27+
var/
28+
wheels/
29+
pip-wheel-metadata/
30+
share/python-wheels/
31+
*.egg-info/
32+
.installed.cfg
33+
*.egg
34+
MANIFEST
35+
36+
# Virtual environments
37+
venv/
38+
env/
39+
ENV/
40+
env.bak/
41+
venv.bak/
42+
43+
# IDE
44+
.vscode/
45+
.idea/
46+
*.swp
47+
*.swo
48+
*~
49+
50+
# OS
51+
.DS_Store
52+
.DS_Store?
53+
._*
54+
.Spotlight-V100
55+
.Trashes
56+
ehthumbs.db
57+
Thumbs.db
58+
59+
# Environment variables
60+
.env
61+
.env.local
62+
.env.development.local
63+
.env.test.local
64+
.env.production.local
65+
66+
# Google Cloud SDK
67+
google-cloud-sdk/
68+
y/
69+
70+
# Temporary files
71+
*.tmp
72+
*.temp
73+
temp/
74+
tmp/

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2024 Citrus IO - GCP Infrastructure Audit Tool
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎Quickstart.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Set-up: Create the virtual environment
2+
python3 -m venv venv
3+
source venv/bin/activate
4+
5+
# Make sure GCP CLI is installed and authenticated
6+
curl -O https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-464.0.0-darwin-arm.tar.gz
7+
tar -xf google-cloud-cli-464.0.0-darwin-arm.tar.gz
8+
./google-cloud-sdk/install.sh
9+
10+
# Reconmendation: Install to path
11+
echo 'source ~/google-cloud-sdk/path.bash.inc' >> ~/.bash_profile
12+
source ~/.bash_profile
13+
14+
# Or use Google's interactive script
15+
Go to the official documentation: https://cloud.google.com/sdk/docs/install-sdk#mac
16+
17+
Download the latest .tar.gz (the link on the page will always point to the latest).
18+
19+
Extract it.
20+
21+
Run the ./google-cloud-sdk/install.sh script.
22+
Follow its prompts. It will handle adding to your PATH and setting up shell completion correctly for your specific shell.
23+
24+
# 1. Install dependencies
25+
pip install -r requirements.txt
26+
27+
# 2. Set up authentication
28+
gcloud auth application-default login
29+
# OR use service account key file
30+
31+
# 3. Run audit (captures current state)
32+
python gcp_audit.py --projects [your-project-id]
33+
34+
# 4. Test rollback (dry run - safe preview)
35+
python gcp_rollback.py gcp_audit_report_20241215_120000.json --dry-run
36+
37+
# 5. Execute rollback if needed
38+
python gcp_rollback.py gcp_audit_report_20241215_120000.json --execute

‎README.md‎

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
# 🍊 Citrus IO - GCP Infrastructure Audit Tool
2+
3+
A comprehensive Google Cloud Platform (GCP) infrastructure auditing tool
4+
5+
```
6+
_______ __ ________
7+
/ ____(_) /________ _______ / _/ __ \
8+
/ / / / __/ ___/ / / / ___/ / // / / /
9+
/ /___/ / /_/ / / /_/ (__ ) _/ // /_/ /
10+
\____/_/\__/_/ \__,_|____/ /___/\____/
11+
```
12+
13+
## ✨ Features
14+
15+
- 🚀 **Auto-discovery**: Automatically finds all accessible GCP projects
16+
- 🔍 **Comprehensive auditing**: Covers IAM, compute, storage, networking, and more
17+
- 📊 **Detailed reporting**: Generates JSON reports with timestamped data
18+
- 📁 **Organized output**: Creates structured audit reports directory
19+
20+
## 🛠️ What Gets Audited
21+
22+
### Project-Level Resources
23+
- ✅ Enabled APIs and services
24+
- ✅ IAM policies and bindings
25+
- ✅ Service accounts and configurations
26+
27+
### Compute Resources
28+
- ✅ Virtual Machine instances
29+
- ✅ Instance metadata and configurations
30+
- ✅ Compute zones and regions
31+
32+
### Storage & Databases
33+
- ✅ Cloud Storage buckets
34+
- ✅ Cloud SQL instances
35+
- ✅ Storage policies and permissions
36+
37+
### Networking
38+
- ✅ VPC networks and subnetworks
39+
- ✅ Firewall rules and priorities
40+
- ✅ Network routing configurations
41+
42+
### Container Services
43+
- ✅ Google Kubernetes Engine (GKE) clusters
44+
- ✅ Node pools and configurations
45+
46+
## 🚀 Quick Start
47+
48+
### Prerequisites
49+
- Python 3.7+
50+
- Google Cloud SDK (gcloud)
51+
- GCP project access with appropriate permissions
52+
53+
### Installation
54+
55+
1. **Clone the repository**:
56+
```bash
57+
git clone <your-repo-url>
58+
cd GCP_audit
59+
```
60+
61+
2. **Install dependencies**:
62+
```bash
63+
pip install -r requirements.txt
64+
```
65+
66+
3. **Authenticate with GCP**:
67+
```bash
68+
gcloud auth application-default login
69+
```
70+
71+
### Usage
72+
73+
**Audit all accessible projects**:
74+
```bash
75+
python gcp_audit_script.py
76+
```
77+
78+
**Audit specific projects**:
79+
```bash
80+
python gcp_audit_script.py --projects project-1 project-2
81+
```
82+
83+
**Use service account credentials**:
84+
```bash
85+
python gcp_audit_script.py --credentials /path/to/service-account-key.json
86+
```
87+
88+
## 📊 Sample Output
89+
90+
```
91+
[19:10:39] 🚀 Initializing GCP Auditor...
92+
[19:10:39] 🔐 Using Application Default Credentials
93+
[19:10:39] 🔧 Initializing GCP clients...
94+
[19:10:51] ✅ All clients initialized successfully
95+
96+
_______ __ ________
97+
/ ____(_) /________ _______ / _/ __ \
98+
/ / / / __/ ___/ / / / ___/ / // / / /
99+
/ /___/ / /_/ / / /_/ (__ ) _/ // /_/ /
100+
\____/_/\__/_/ \__,_|____/ /___/\____/
101+
102+
[19:10:51] 🚀 Starting GCP Infrastructure Audit...
103+
[19:10:51] 📋 Will audit 3 projects
104+
[19:10:51] 📊 [1/3] Processing project: production-app
105+
[19:10:51] 🔍 Auditing project: production-app
106+
[19:10:51] 🔌 Getting enabled APIs for production-app
107+
[19:10:51] ✅ Found 25 enabled APIs
108+
[19:10:51] 🔐 Getting IAM policy for production-app
109+
[19:10:52] ✅ Found 12 IAM bindings
110+
[19:10:52] 💻 Getting compute instances for production-app
111+
[19:10:53] ✅ Found 5 compute instances
112+
```
113+
114+
## 🔐 Required Permissions
115+
116+
The tool requires the following IAM roles:
117+
118+
### For Read-Only Auditing
119+
```bash
120+
roles/viewer
121+
roles/iam.securityReviewer
122+
roles/serviceusage.serviceUsageViewer
123+
```
124+
125+
### For Organization-Level Access
126+
```bash
127+
roles/resourcemanager.organizationViewer
128+
roles/resourcemanager.folderViewer
129+
```
130+
131+
## 📁 Output Structure
132+
133+
Reports are saved in the `audit_reports/` directory:
134+
135+
```
136+
audit_reports/
137+
└── gcp_audit_report_20241227_191051.json
138+
```
139+
140+
### Report Format
141+
```json
142+
{
143+
"audit_metadata": {
144+
"timestamp": "2024-12-27T19:10:51",
145+
"auditor_version": "1.0.0",
146+
"projects_audited": 3
147+
},
148+
"projects": {
149+
"project-id": {
150+
"project_id": "project-id",
151+
"enabled_apis": [...],
152+
"iam_policy": {...},
153+
"service_accounts": [...],
154+
"compute_instances": [...],
155+
"storage_buckets": [...],
156+
"network_info": {...}
157+
}
158+
}
159+
}
160+
```
161+
162+
## 🛡️ Security Features
163+
164+
- **Credential Protection**: Never logs or stores credentials
165+
- **Safe Defaults**: Read-only operations by default
166+
- **Error Handling**: Graceful handling of permission errors
167+
- **Audit Trail**: Comprehensive logging of all operations
168+
169+
## 🔧 Configuration
170+
171+
### Environment Variables
172+
```bash
173+
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account-key.json
174+
export GOOGLE_CLOUD_PROJECT=default-project-id
175+
```
176+
177+
### Command Line Options
178+
```bash
179+
python gcp_audit_script.py --help
180+
181+
optional arguments:
182+
--credentials PATH Path to service account JSON file
183+
--projects [PROJECT_IDS ...] Specific project IDs to audit
184+
--output FILENAME Output file name (default: timestamped)
185+
```
186+
187+
## 🤝 Contributing
188+
189+
1. Fork the repository
190+
2. Create a feature branch
191+
3. Make your changes
192+
4. Add tests if applicable
193+
5. Submit a pull request
194+
195+
## 📝 License
196+
197+
This project is licensed under the MIT License - see the LICENSE file for details.
198+
199+
200+
--**⚠️ Important**: This tool performs read-only operations by default. Always test in non-production environments first.

0 commit comments

Comments
 (0)