GCP Misconfiguration

Detects common Google Cloud Platform security misconfigurations including public storage buckets, overprivileged service accounts, and disabled audit logging.

zakirkun Updated

File contents

GCP Misconfiguration

Overview

Common GCP security misconfigurations:

  1. Public Cloud Storage buckets: allUsers or allAuthenticatedUsers access
  2. Service account key file exposure: SA keys committed to version control
  3. Overprivileged service accounts: roles/editor or roles/owner granted
  4. Default service account auto-mount: Pods automatically get default SA token
  5. Disabled audit logging: Data access logs disabled
  6. GKE legacy ABAC: Insecure legacy authorization model

Remediation

  • Enable Uniform Bucket-Level Access to prevent per-object ACLs
  • Use Workload Identity instead of service account key files
  • Follow principle of least privilege for IAM bindings
  • Enable VPC Service Controls

zakirkun/ice-tea/tree/main/skills/cloud/gcp-misconfiguration commit da1a472993

Frequently asked questions

npx skillmds@latest add zakirkun/gcp-misconfiguration