{"id":50656048,"url":"https://github.com/GoogleCloudPlatform/gcp-hardening-toolkit","last_synced_at":"2026-06-24T20:00:33.916Z","repository":{"id":327809132,"uuid":"1110617328","full_name":"GoogleCloudPlatform/gcp-hardening-toolkit","owner":"GoogleCloudPlatform","description":"Deep GCP security hardening via automated triage and state-aware IaC. Built to power rapid, agile task-force engagements and remediate complex brownfield environments at scale.","archived":false,"fork":false,"pushed_at":"2026-06-10T20:04:23.000Z","size":488,"stargazers_count":40,"open_issues_count":3,"forks_count":11,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-10T21:17:53.070Z","etag":null,"topics":["compliance-as-code","gcp","gemini-cli-extension","google-cloud-platform","policy-as-code","security-hardening","terraform"],"latest_commit_sha":null,"homepage":"https://codewiki.google/github.com/googlecloudplatform/gcp-hardening-toolkit","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GoogleCloudPlatform.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"docs/contributing.md","funding":null,"license":"LICENSE","code_of_conduct":"docs/code-of-conduct.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-12-05T13:15:19.000Z","updated_at":"2026-06-08T18:03:38.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/GoogleCloudPlatform/gcp-hardening-toolkit","commit_stats":null,"previous_names":["googlecloudplatform/gcp-hardening-toolkit"],"tags_count":63,"template":false,"template_full_name":null,"purl":"pkg:github/GoogleCloudPlatform/gcp-hardening-toolkit","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoogleCloudPlatform%2Fgcp-hardening-toolkit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoogleCloudPlatform%2Fgcp-hardening-toolkit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoogleCloudPlatform%2Fgcp-hardening-toolkit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoogleCloudPlatform%2Fgcp-hardening-toolkit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GoogleCloudPlatform","download_url":"https://codeload.github.com/GoogleCloudPlatform/gcp-hardening-toolkit/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoogleCloudPlatform%2Fgcp-hardening-toolkit/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34747387,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-24T02:00:07.484Z","response_time":106,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["compliance-as-code","gcp","gemini-cli-extension","google-cloud-platform","policy-as-code","security-hardening","terraform"],"created_at":"2026-06-08T00:00:28.186Z","updated_at":"2026-06-24T20:00:33.901Z","avatar_url":"https://github.com/GoogleCloudPlatform.png","language":"HCL","funding_links":[],"categories":["Security","Compliance-Ready Modules"],"sub_categories":["GCP"],"readme":"# GCP Hardening Toolkit (GHT)\n\n![Terraform](https://img.shields.io/badge/Terraform-%3E%3D1.3-935ADA?style=for-the-badge\u0026logo=terraform\u0026logoColor=white)\n![Python](https://img.shields.io/badge/Python-3.x-3776AB?style=for-the-badge\u0026logo=python\u0026logoColor=white)\n![Bash](https://img.shields.io/badge/Bash-Shell-4EAA25?style=for-the-badge\u0026logo=gnu-bash\u0026logoColor=white)\n![License](https://img.shields.io/badge/License-Apache%202.0-blue?style=for-the-badge)\n[![Technical Guides](https://img.shields.io/badge/YouTube-Technical_Guides-C0392B?style=for-the-badge\u0026logo=youtube\u0026logoColor=white)](https://www.youtube.com/watch?v=hrbTj3YUhlQ\u0026list=PLJKGPxH0mLCrZDBQbSAGP8O_ig2o4iZM9\u0026index=1)\n\nStandard foundational toolkits assume a clean slate. The reality is you are likely dealing with active, undocumented, and messy infrastructure (brownfield environments).\n\nThe **GCP Hardening Toolkit (GHT)** is an automated triage and remediation engine built for this exact reality. Its core component is the **Hardening Agent**—an interactive CLI assistant that audits your live environment, identifies security debt, and deploys incremental compliance guardrails using state-aware Infrastructure as Code (IaC) without disrupting active DevOps pipelines.\n\n---\n\n## The Hardening Agent\n\nThe Hardening Agent is the brain of the toolkit. Instead of blindly enforcing restrictive policies, it reads your current infrastructure state, analyzes existing vulnerabilities, and generates targeted, safe Terraform blueprints to fix them.\n\n### 1. Prerequisite: Agent Setup Blueprint\nBecause the Agent grounds its decisions in your live environment data, you must first deploy its restricted infrastructure.\n\nNavigate to `blueprints/agent-setup/` and deploy the setup blueprint. This provisions the least-privilege Service Account, BigQuery datasets, and Cloud Storage buckets the agent needs, alongside the exact bash scripts (`export_org_state.sh` / `export_project_state.sh`) required to safely dump your Cloud Asset Inventory (CAI) and Security Command Center (SCC) data for analysis.\n\n### 2. Installation\nInstall the Hardening Agent as a Gemini CLI extension:\n\n```bash\ngemini extensions install https://github.com/GoogleCloudPlatform/gcp-hardening-toolkit\n```\n*For complete architecture and command details, see the [Hardening Agent Documentation](agent/README.md).*\n\n---\n\n## The Toolkit Payload (Blueprints \u0026 Modules)\n\nThe repository provides the raw materials the Agent uses to secure your environment. It is decoupled into two main layers:\n\n*   **Modules (`modules/`):** Reusable, stateless, and minimal wrappers around Terraform resources (e.g., specific org policy constraints).\n*   **Blueprints (`blueprints/`):** Deployable, stateful solutions built from modules. The Agent generates or modifies these to fit your specific requirements.\n\n### Core Capabilities\n\n*   **Triage \u0026 Remediation:** Automate investigation and decision-making for SCC alerts, reducing alert fatigue and manual review.\n*   **Targeted Constraints:** Block lateral movement by deploying precise Org Policies (e.g., restricting service account creation) only where safe.\n*   **Frictionless Compliance:** Deploy comprehensive security baselines (like HIPAA or PCI-DSS guardrails) incrementally.\n*   **Advanced Detection:** Extend native GCP observability with custom threat detection pipelines and log routing.\n\n---\n\n## GHT vs. Cloud Foundation Toolkit (CFT)\n\nIf you are building a new Google Cloud organization from scratch (greenfield), use the [Cloud Foundation Toolkit (CFT)](https://github.com/GoogleCloudPlatform/cloud-foundation-toolkit).\n\n**Use GHT if:**\n* You are conducting a Cloud Security Posture Review (CSPR) and need to fix active, messy infrastructure.\n* You need to accelerate compliance but cannot afford to break current production operations.\n* You want an automated agent to do the heavy lifting of mapping dependencies before applying restrictive policies.\n\n| Feature | Cloud Foundation Toolkit (CFT) | GCP Hardening Agent \u0026 Toolkit (GHT) |\n| :--- | :--- | :--- |\n| **Primary Use Case** | Building new infrastructure (Greenfield). | Triaging and hardening active environments (Brownfield). |\n| **Execution** | Static Terraform Blueprints. | Automated Agent + State-Aware IaC. |\n| **Environment State** | Assumes a standard \"clean slate\". | Reads and respects your live, current state and tech debt. |\n| **Guardrail Strategy** | Broad, top-down baseline enforcement. | Targeted, triage-based incremental enforcement. |\n| **DevOps Friction** | High (if forced onto existing infra). | Low (fixes issues without breaking apps). |\n\n---\n\n## Usage Workflow\n\nIf you are not using the interactive Hardening Agent, you can deploy blueprints manually:\n\n1.  **Select:** Choose a solution from `blueprints/` that matches your tactical goal.\n2.  **Customize:** Review the `examples` or adjust the `variables.tf` to fit your scope.\n3.  **Execute:**\n```bash\ncd blueprints/gcp-foundation-org-iam\nterraform init\nterraform apply\n```\n\n## Release Cycle \u0026 Supply Chain Security\n\nWe use a **Rolling Release** model. Every commit to `main` is stable. To protect your production environments from unintended updates, **always pin modules to a specific commit hash**:\n\n```hcl\nmodule \"gcp_hardening\" {\n  source = \"[github.com/GoogleCloudPlatform/gcp-hardening-toolkit//modules/gcp-org-policies?ref=](https://github.com/GoogleCloudPlatform/gcp-hardening-toolkit//modules/gcp-org-policies?ref=)\u003cCOMMIT_HASH\u003e\"\n}\n```\n\n## Contributing \u0026 Feedback\nContributions are welcome. See our [Contributing Guide](docs/contributing.md) for rules of engagement.\n\nTo help us prioritize automation features and improve the agent, please share your operational feedback.\n[Take the 1-Minute Survey](https://forms.gle/LmgxXbJBoqu91dyA9)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FGoogleCloudPlatform%2Fgcp-hardening-toolkit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FGoogleCloudPlatform%2Fgcp-hardening-toolkit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FGoogleCloudPlatform%2Fgcp-hardening-toolkit/lists"}