README
¶
Google Cloud Platform IAM role checker
This tool allows you to gain an insight into what permissions a given user account, service account or group (collectively known as members in GCP) has across the resources within your organisation.
Prerequisites
- Go 1.8+
- Python 3.6+
- Google Cloud SDK
Installation
go get github.com/ONSdigital/gcp-role-checker
Basic usage
gcloud auth login
cd ${GOPATH}/src/github.com/ONSdigital/gcp-role-checker
python scripts/audit_service_accounts.py organizations/<my organisation id>
Functionality
This script will query a collection of Google's APIs to gather:
- All projects in organisation
- All folders in organisation
- All built-in IAM roles
- All custom IAM roles defined on the organisation and any projects and folders within it
- All permission scopes associated with the roles
- All IAM bindings (I.e. user/service account -> role) on the organisation and any projects and folders within it
It will output the raw results to JSON files.
The audit_service_accounts.py script will then use these files to print out a view of the data.
Parameters
--project_labels
Optional
Allows the projects queried to be restricted by labels.
python scripts/audit_service_accounts.py \
--project_labels=env:dev,project:foo \
organizations/999999999999
Labels are defined as key:value. Multiple labels can be added by comma-separating them; these will be ANDed together.
This may be used to only audit projects used in production.
--data_dir
Optional
The directory used by the Go script to output the collected data. B
Default: a data folder in the package root.
--limit
Optional
Limits the number of members to print in the output.
Default: 10
--member_type
Optional
Filters the members by their type.
Supported values:
- service_account
- user_account
- group
--skip_collect
Optional
Specifies whether to skip the data gathering step. Use this to avoid unnecessarily hammering the Google APIs.
Is this is flagged then gathered data must already be available in the --data_dir directory.
python scripts/audit_service_accounts.py --skip_collect organizations/999999999999
--sort_type
Optional
Alters the sort function used to order the members.
Supported values:
total_sum
Sorts by the sum of all permissions an account holds across all resources. Useful to find members that have broad permissions across the organisation
top_sum
Sorts by the sum permissions an account has on its most-privileged resource. This will tend to highlight members with roles/owner access so best to use in conjunction with the --member_type parameter
Default: total_sum
Directories