https://github.com/doitintl/galactus
A tool for detecting unused Service Accounts and Service Account Keys on GCP
https://github.com/doitintl/galactus
Last synced: 11 months ago
JSON representation
A tool for detecting unused Service Accounts and Service Account Keys on GCP
- Host: GitHub
- URL: https://github.com/doitintl/galactus
- Owner: doitintl
- License: mit
- Created: 2022-07-18T11:18:04.000Z (about 4 years ago)
- Default Branch: main
- Last Pushed: 2022-11-10T16:11:03.000Z (over 3 years ago)
- Last Synced: 2025-08-28T22:01:14.585Z (11 months ago)
- Language: Python
- Size: 13.7 KB
- Stars: 4
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE.md
Awesome Lists containing this project
README
# Galactus - unused GCP Service Account/Key detector
This script uses GCP's [Policy Analyzer](https://cloud.google.com/policy-intelligence/docs/activity-analyzer-service-account-authentication) feature to detect unused Service Accounts (SA) or Service Account Keys (SAK).
## Prerequisites
- [gcloud](https://cloud.google.com/sdk/docs/install) installed and in PATH
- Python 3
- Enabling the [Policy Analyzer API](https://cloud.google.com/policy-intelligence/docs/activity-analyzer-service-account-authentication#before-you-begin)
## Script arguments
```bash
$ ./galactus --help
usage: galactus [-h] -p PROJECT -a ACTIVITY_TYPE [-l LIMIT] -t THRESHOLD [-d]
Unused GCP Service Account and Key detector
options:
-h, --help show this help message and exit
-p PROJECT, --project PROJECT
GCP Project name
-a ACTIVITY_TYPE, --activity-type ACTIVITY_TYPE
Activity type (serviceAccountLastAuthentication / serviceAccountKeyLastAuthentication)
-l LIMIT, --limit LIMIT
Result limit
-t THRESHOLD, --threshold THRESHOLD
Date threshold in format "%Y-%m-%dT%H:%M:%SZ"
-d, --debug Enable debug logging
```
### Using environment variables
The following environment variable can be used instead of command line arguments (arguments take precedence):
- GCP_PROJECT - instead of -p/--project
- ACTIVITY_TYPE - instead of -a/--activity-type
- THRESHOLD - instead of -t/--threshold
- DEBUG - instead of -d/--debug
## Examples
Find SA that were not used since before 1.5.2022:
```bash
$ ./galactus -p test-eyal -t 2022-05-01T00:00:00Z -a serviceAccountLastAuthentication
2022-07-15 17:35:25,078 - INFO - //iam.googleapis.com/projects/test-eyal/serviceAccounts/crossplane-test@test-eyal.iam.gserviceaccount.com - last used 2022-02-28T08:00:00Z
```
Find SAK that were not used since before 28.2.2022 at 10AM:
```bash
$ ./galactus -p test-eyal -t 2022-02-28T10:00:00Z -a serviceAccountKeyLastAuthentication
2022-07-15 17:36:52,823 - INFO - //iam.googleapis.com/projects/test-eyal/serviceAccounts/crossplane-test@test-eyal.iam.gserviceaccount.com/keys/b2edfc3fc441c9937c0c2e0da2b1345d57a02abb - last used 2022-02-28T08:00:00Z
```
## Deploying to GKE
Example manifests can be found in the [kustomize](./kustomize/) directory. Do the following before applying:
- build and push the image: `docker build -t : src && docker push :`
- update the registry and tag inside [kustomization.yaml](./kustomize/kustomization.yaml)
- update the GCP project name in [configmap.yaml](./kustomize/configmap.yaml)
- if using [Workload Identity](https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity), configure the GSA with the [necessary roles](https://cloud.google.com/policy-intelligence/docs/activity-analyzer-service-account-authentication#required-permissions) and update the GSA email in [serviceaccount.yaml](./kustomize/serviceaccount.yaml)
- if necessary, tweak schedule [cronjob.yaml](./kustomize/cronjob.yaml)
- apply the manifests to the cluster: `kubectl apply -k kustomize`