https://github.com/marcin-kolda/gcp-iam-collector

Python script for collecting and visualising Google Cloud Platform IAM permissions
https://github.com/marcin-kolda/gcp-iam-collector

google-cloud security-audit security-tools

Last synced: 25 days ago
JSON representation

Python script for collecting and visualising Google Cloud Platform IAM permissions

• Host: GitHub
• URL: https://github.com/marcin-kolda/gcp-iam-collector
• Owner: marcin-kolda
• License: apache-2.0
• Created: 2017-04-11T20:27:33.000Z (over 7 years ago)
• Default Branch: master
• Last Pushed: 2017-04-23T12:54:47.000Z (over 7 years ago)
• Last Synced: 2024-08-03T18:16:39.881Z (4 months ago)
• Topics: google-cloud, security-audit, security-tools
• Language: Python
• Homepage:
• Size: 206 KB
• Stars: 50
• Watchers: 5
• Forks: 13
• Open Issues: 1
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-cloud-security - 地址 - kolda/gcp-iam-collector) (0x02 工具 :hammer_and_wrench: / 1 云服务工具)
• awesome-devsecops-russia - gcp-iam-collector

README

        
# gcp-iam-collector

Python scripts for collecting and visualising [Google Cloud Platform](https://cloud.google.com/) IAM permissions

GCP IAM graph is created using [vis.js](http://visjs.org/) and it's static HTML page, see [example interactive graph](https://storage.googleapis.com/gcp-iam-collector/iam_graph_example.html)

[![Example graph](https://raw.githubusercontent.com/marcin-kolda/gcp-iam-collector/master/example_graph.png)](https://storage.googleapis.com/gcp-iam-collector/iam_graph_example.html)

## Features

GCP IAM collector iterates over projects using [Google Cloud Resource Manager API](https://cloud.google.com/resource-manager/reference/rest/v1/projects/list) and dumps to CSV files:

* all available GCP projects,

* projects IAM permissions,

* projects service account and their keys,

* BigQuery dataset ACLs,

* Cloud Storage bucket ACLs

IAM graph currently supports:

* GCP projects and their permissions,

* Service accounts and their permissions

# Setup

1. Install dependencies:

```

pip install -r requirements.txt

```

2. Install [gcloud](https://cloud.google.com/sdk/gcloud/) CLI tool.

3. Setup [Google Application Default Credentials](https://developers.google.com/identity/protocols/application-default-credentials):

```

gcloud auth application-default login

```

# Run Instructions

Command below dumps all IAM to csv files

```

python collector.py

```

Creating interactive graph:

```

python create_iam_graph.py

```