Install this skill

npx skills add mukul975/Anthropic-Cybersecurity-Skills

Framework mappings

MITRE ATT&CK

T1078.004 T1098.003 T1528 T1548.005 T1580

NIST CSF 2.0

When to Use

When performing security assessments of GCP organization or project IAM configurations
When identifying service accounts with excessive permissions or unused access
When compliance requirements mandate review of access controls and role assignments
When investigating potential lateral movement through IAM misconfigurations
When reducing the blast radius of compromised credentials by scoping down permissions

Do not use for VPC firewall rule auditing (use network security tools), for GKE RBAC auditing (use Kubernetes-specific RBAC tools), or for real-time threat detection on IAM actions (use SCC Event Threat Detection).

Prerequisites

GCP organization or project with roles/iam.securityReviewer and roles/cloudAsset.viewer
gcloud CLI authenticated with appropriate permissions
Cloud Asset API enabled (gcloud services enable cloudasset.googleapis.com)
IAM Recommender API enabled (gcloud services enable recommender.googleapis.com)
Policy Analyzer API enabled (gcloud services enable policyanalyzer.googleapis.com)

Workflow

Step 1: Enumerate IAM Bindings Across the Organization

List all IAM bindings at organization, folder, and project levels to understand the full access landscape.

# Organization-level IAM bindings
gcloud organizations get-iam-policy ORG_ID \
  --format=json > org-iam-policy.json
 
# Search all IAM policies across the organization
gcloud asset search-all-iam-policies \
  --scope=organizations/ORG_ID \
  --format="table(resource, policy.bindings.role, policy.bindings.members)" \
  --limit=500
 
# Find all users and service accounts with Owner role
gcloud asset search-all-iam-policies \
  --scope=organizations/ORG_ID \
  --query="policy:roles/owner" \
  --format="table(resource, policy.bindings.members)"
 
# Find all bindings using primitive roles (Owner, Editor, Viewer)
gcloud asset search-all-iam-policies \
  --scope=organizations/ORG_ID \
  --query="policy:roles/owner OR policy:roles/editor" \
  --format=json | python3 -c "
import json, sys
data = json.load(sys.stdin)
for result in data:
    resource = result.get('resource', '')
    for binding in result.get('policy', {}).get('bindings', []):
        role = binding.get('role', '')
        if role in ['roles/owner', 'roles/editor']:
            for member in binding.get('members', []):
                print(f'{resource} | {role} | {member}')
"

Step 2: Audit Service Accounts and Their Keys

Identify service accounts with excessive permissions, user-managed keys, and unused accounts.

# List all service accounts in a project
gcloud iam service-accounts list \
  --project=PROJECT_ID \
  --format="table(email, displayName, disabled)"
 
# Check for user-managed keys (should be minimized)
for sa in $(gcloud iam service-accounts list --project=PROJECT_ID --format="value(email)"); do
  keys=$(gcloud iam service-accounts keys list \
    --iam-account="$sa" \
    --managed-by=user \
    --format="table(name.basename(),validAfterTime,validBeforeTime)")
  if [ -n "$keys" ]; then
    echo "=== $sa ==="
    echo "$keys"
  fi
done
 
# Find service accounts with admin roles across all projects
gcloud asset search-all-iam-policies \
  --scope=organizations/ORG_ID \
  --query="policy.bindings.members:serviceAccount AND (policy:roles/owner OR policy:roles/editor OR policy:admin)" \
  --format="table(resource, policy.bindings.role, policy.bindings.members)"
 
# Check service account IAM policies (who can impersonate)
for sa in $(gcloud iam service-accounts list --project=PROJECT_ID --format="value(email)"); do
  echo "=== $sa ==="
  gcloud iam service-accounts get-iam-policy "$sa" --format=json 2>/dev/null
done

Step 3: Use IAM Recommender to Identify Excess Permissions

Leverage GCP's IAM Recommender to find roles that grant more access than actually used.

# List IAM role recommendations for a project
gcloud recommender recommendations list \
  --project=PROJECT_ID \
  --recommender=google.iam.policy.Recommender \
  --location=global \
  --format="table(name, description, priority, stateInfo.state)"
 
# Get detailed recommendation
gcloud recommender recommendations describe RECOMMENDATION_ID \
  --project=PROJECT_ID \
  --recommender=google.iam.policy.Recommender \
  --location=global \
  --format=json
 
# List insights about IAM usage
gcloud recommender insights list \
  --project=PROJECT_ID \
  --insight-type=google.iam.policy.Insight \
  --location=global \
  --format="table(name, description, severity, category)"
 
# Apply a recommendation (after review)
gcloud recommender recommendations mark-claimed RECOMMENDATION_ID \
  --project=PROJECT_ID \
  --recommender=google.iam.policy.Recommender \
  --location=global \
  --etag=ETAG

Step 4: Analyze Effective Permissions with Policy Analyzer

Use Policy Analyzer to determine effective access for specific principals or resources.

# Check who has access to a specific resource
gcloud asset analyze-iam-policy \
  --organization=ORG_ID \
  --full-resource-name="//storage.googleapis.com/projects/_/buckets/sensitive-data-bucket" \
  --format="table(identityList.identities, accessControlLists.accesses.role)"
 
# Check what resources a specific user can access
gcloud asset analyze-iam-policy \
  --organization=ORG_ID \
  --identity="user:developer@company.com" \
  --format="table(accessControlLists.resources.fullResourceName, accessControlLists.accesses.role)"
 
# Check who can perform a specific action
gcloud asset analyze-iam-policy \
  --organization=ORG_ID \
  --full-resource-name="//cloudresourcemanager.googleapis.com/projects/PROJECT_ID" \
  --permissions="iam.serviceAccounts.actAs,iam.serviceAccountKeys.create" \
  --format="table(identityList.identities, accessControlLists.accesses.permission)"
 
# Find all principals with allUsers or allAuthenticatedUsers access
gcloud asset search-all-iam-policies \
  --scope=organizations/ORG_ID \
  --query="policy:allUsers OR policy:allAuthenticatedUsers" \
  --format="table(resource, policy.bindings.role, policy.bindings.members)"

Step 5: Check for Domain-Wide Delegation and Impersonation Risks

Identify service accounts with domain-wide delegation and impersonation capabilities.

# Check for service accounts with domain-wide delegation
# (Requires Admin SDK access to list delegated accounts)
gcloud iam service-accounts list --project=PROJECT_ID --format=json | python3 -c "
import json, sys
accounts = json.load(sys.stdin)
for sa in accounts:
    email = sa.get('email', '')
    # Check if the SA has domain-wide delegation enabled
    # This requires Admin SDK API access
    print(f'SA: {email} - Check admin.google.com for delegation status')
"
 
# Find service accounts that other identities can impersonate
for sa in $(gcloud iam service-accounts list --project=PROJECT_ID --format="value(email)"); do
  policy=$(gcloud iam service-accounts get-iam-policy "$sa" --format=json 2>/dev/null)
  if echo "$policy" | python3 -c "
import json, sys
p = json.load(sys.stdin)
for b in p.get('bindings', []):
    if b['role'] in ['roles/iam.serviceAccountTokenCreator', 'roles/iam.serviceAccountUser']:
        print(f'  {b[\"role\"]}: {b[\"members\"]}')
" 2>/dev/null; then
    echo "=== Impersonation risk: $sa ==="
  fi
done

Step 6: Generate Audit Report and Apply Remediation

Compile findings and implement recommended permission reductions.

# Remove primitive role and replace with predefined role
gcloud projects remove-iam-policy-binding PROJECT_ID \
  --member="user:developer@company.com" \
  --role="roles/editor"
 
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="user:developer@company.com" \
  --role="roles/compute.viewer"
 
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="user:developer@company.com" \
  --role="roles/storage.objectViewer"
 
# Delete unused service account keys
gcloud iam service-accounts keys delete KEY_ID \
  --iam-account=SA_EMAIL
 
# Disable unused service accounts
gcloud iam service-accounts disable SA_EMAIL --project=PROJECT_ID

Key Concepts

Term	Definition
Primitive Role	Legacy GCP roles (Owner, Editor, Viewer) that grant broad permissions across all services, not recommended for production
Predefined Role	GCP-managed role scoped to specific services and actions, providing more granular access than primitive roles
IAM Recommender	GCP ML-based service that analyzes actual permission usage and suggests role reductions to achieve least privilege
Policy Analyzer	Tool for analyzing effective IAM access across the organization hierarchy, answering who-can-access-what queries
Service Account Key	User-managed credential for service account authentication, a security risk as keys can be exported and do not auto-expire
Domain-Wide Delegation	Grants a service account the ability to impersonate any user in the Google Workspace domain, a significant privilege escalation risk

Tools & Systems

gcloud CLI: Primary tool for querying and managing GCP IAM policies, service accounts, and role bindings
IAM Recommender: ML-based recommendation engine for reducing excessive permissions based on actual usage
Policy Analyzer: Organization-wide effective access analysis tool for understanding who can access what
Cloud Asset Inventory: Cross-project search for IAM policies and resource metadata
ScoutSuite: Multi-cloud auditing tool with GCP IAM-specific checks for role assignments and service accounts

Common Scenarios

Scenario: Reducing Primitive Role Usage Across a GCP Organization

Context: An audit reveals that 60% of IAM bindings across the organization use primitive roles (Owner/Editor). The security team needs to migrate to predefined roles without disrupting developer workflows.

Approach:

Run gcloud asset search-all-iam-policies to inventory all primitive role bindings
Use IAM Recommender to get ML-based suggestions for replacement predefined roles
For each binding, use Policy Analyzer to understand what the principal actually accesses
Create a mapping document: primitive role -> specific predefined roles needed
Apply predefined roles alongside primitive roles for a testing period
Monitor for access denied errors using Cloud Audit Logs
Remove primitive roles after confirming no access issues over 2 weeks

Pitfalls: Primitive roles include permissions across all GCP services, so replacing them requires multiple predefined roles. The Recommender may suggest overly restrictive roles if the observation period does not capture all use cases. Custom roles can fill gaps where no predefined role matches the exact permission set needed.

Output Format

GCP IAM Permissions Audit Report
===================================
Organization: acme-org (ORG_ID: 123456789)
Projects Audited: 25
Audit Date: 2026-02-23
 
IAM BINDING SUMMARY:
  Total bindings:                    342
  Using primitive roles:             205 (60%)
  Using predefined roles:            112 (33%)
  Using custom roles:                 25 (7%)
 
CRITICAL FINDINGS:
[IAM-001] Service Account with Owner Role
  SA: admin-sa@prod-project.iam.gserviceaccount.com
  Role: roles/owner on project prod-project
  User-Managed Keys: 3 (oldest: 14 months)
  Remediation: Replace with specific predefined roles, delete old keys
 
[IAM-002] allAuthenticatedUsers Binding
  Resource: gs://public-data-bucket
  Role: roles/storage.objectViewer
  Risk: Any Google account holder can read bucket contents
  Remediation: Restrict to specific user groups or service accounts
 
SERVICE ACCOUNT HEALTH:
  Total service accounts:            67
  With user-managed keys:            23
  Keys older than 90 days:           18
  Unused accounts (90+ days):        12
  With domain-wide delegation:        2
 
RECOMMENDER SUGGESTIONS:
  Total recommendations:             45
  Priority HIGH:                     12
  Estimated permissions reduced:     2,847 individual permissions

Source materials

References and resources

Everything below is rendered for inspection. Script files are read-only and never run.

References 1

api-reference.md2.2 KB

API Reference: Auditing GCP IAM Permissions

google-cloud-asset

Search All IAM Policies

from google.cloud import asset_v1
 
client = asset_v1.AssetServiceClient()
request = asset_v1.SearchAllIamPoliciesRequest(
    scope="organizations/ORG_ID",
    query="policy:roles/owner",
    page_size=500,
)
for result in client.search_all_iam_policies(request=request):
    print(result.resource, result.policy.bindings)

Analyze IAM Policy (Who Can Access What)

request = asset_v1.AnalyzeIamPolicyRequest(
    analysis_query=asset_v1.IamPolicyAnalysisQuery(
        scope="organizations/ORG_ID",
        identity_selector=asset_v1.IamPolicyAnalysisQuery.IdentitySelector(
            identity="user:dev@company.com"
        ),
    )
)
response = client.analyze_iam_policy(request=request)

google-cloud-iam (Service Accounts)

from google.cloud import iam_admin_v1
 
client = iam_admin_v1.IAMClient()
 
# List service accounts
request = iam_admin_v1.ListServiceAccountsRequest(name="projects/PROJECT_ID")
for sa in client.list_service_accounts(request=request):
    print(sa.email, sa.disabled)
 
# List user-managed keys
key_req = iam_admin_v1.ListServiceAccountKeysRequest(
    name=sa.name,
    key_types=[iam_admin_v1.ListServiceAccountKeysRequest.KeyType.USER_MANAGED],
)

google-cloud-resource-manager

from google.cloud import resourcemanager_v3
 
client = resourcemanager_v3.ProjectsClient()
policy = client.get_iam_policy(request={"resource": "projects/PROJECT_ID"})
for binding in policy.bindings:
    print(binding.role, list(binding.members))

Key GCP IAM Roles to Flag

Role	Risk Level
`roles/owner`	Critical (full control)
`roles/editor`	High (write access all services)
`roles/iam.serviceAccountTokenCreator`	High (impersonation)
`roles/iam.serviceAccountKeyAdmin`	High (key creation)

References

google-cloud-asset: https://pypi.org/project/google-cloud-asset/
google-cloud-iam: https://pypi.org/project/google-cloud-iam/
google-cloud-resource-manager: https://pypi.org/project/google-cloud-resource-manager/
GCP IAM docs: https://cloud.google.com/iam/docs

Scripts 1

agent.py6.0 KB

Display-only source. This catalog never executes bundled scripts.

#!/usr/bin/env python3
"""Agent for auditing GCP IAM permissions using google-cloud libraries."""

import json
import argparse
from datetime import datetime

from google.cloud import asset_v1
from google.cloud import resourcemanager_v3


def search_iam_policies(scope, query=""):
    """Search IAM policies across the GCP organization."""
    client = asset_v1.AssetServiceClient()
    request = asset_v1.SearchAllIamPoliciesRequest(scope=scope, query=query, page_size=500)
    results = []
    for result in client.search_all_iam_policies(request=request):
        for binding in result.policy.bindings:
            results.append({
                "resource": result.resource,
                "role": binding.role,
                "members": list(binding.members),
            })
    return results


def find_primitive_roles(scope):
    """Find all IAM bindings using primitive roles (Owner, Editor)."""
    query = "policy:roles/owner OR policy:roles/editor"
    return search_iam_policies(scope, query)


def find_public_bindings(scope):
    """Find resources accessible to allUsers or allAuthenticatedUsers."""
    query = "policy:allUsers OR policy:allAuthenticatedUsers"
    return search_iam_policies(scope, query)


def list_service_accounts(project_id):
    """List all service accounts in a project with key info."""
    from google.cloud import iam_admin_v1
    client = iam_admin_v1.IAMClient()
    request = iam_admin_v1.ListServiceAccountsRequest(name=f"projects/{project_id}")
    accounts = []
    for sa in client.list_service_accounts(request=request):
        sa_info = {
            "email": sa.email,
            "display_name": sa.display_name,
            "disabled": sa.disabled,
            "user_managed_keys": [],
        }
        key_request = iam_admin_v1.ListServiceAccountKeysRequest(
            name=sa.name,
            key_types=[iam_admin_v1.ListServiceAccountKeysRequest.KeyType.USER_MANAGED],
        )
        keys = client.list_service_account_keys(request=key_request)
        for key in keys.keys:
            sa_info["user_managed_keys"].append({
                "name": key.name.split("/")[-1],
                "valid_after": str(key.valid_after_time),
                "valid_before": str(key.valid_before_time),
            })
        accounts.append(sa_info)
    return accounts


def get_project_iam_policy(project_id):
    """Get IAM policy for a specific project."""
    client = resourcemanager_v3.ProjectsClient()
    request = {"resource": f"projects/{project_id}"}
    policy = client.get_iam_policy(request=request)
    bindings = []
    for binding in policy.bindings:
        bindings.append({"role": binding.role, "members": list(binding.members)})
    return bindings


def analyze_permissions(scope, identity):
    """Analyze what resources an identity can access."""
    client = asset_v1.AssetServiceClient()
    request = asset_v1.AnalyzeIamPolicyRequest(
        analysis_query=asset_v1.IamPolicyAnalysisQuery(
            scope=scope,
            identity_selector=asset_v1.IamPolicyAnalysisQuery.IdentitySelector(
                identity=identity
            ),
        )
    )
    response = client.analyze_iam_policy(request=request)
    results = []
    for entry in response.main_analysis.analysis_results:
        for acl in entry.access_control_lists:
            resources = [r.full_resource_name for r in acl.resources]
            accesses = [a.role for a in acl.accesses]
            results.append({"resources": resources, "roles": accesses})
    return results


def classify_risk(bindings):
    """Classify risk for IAM bindings."""
    critical = []
    high = []
    for b in bindings:
        role = b.get("role", "")
        members = b.get("members", [])
        if "allUsers" in members or "allAuthenticatedUsers" in members:
            critical.append(b)
        elif role in ("roles/owner", "roles/editor"):
            for m in members:
                if "serviceAccount" in m:
                    critical.append(b)
                    break
            else:
                high.append(b)
    return {"critical": critical, "high": high}


def main():
    parser = argparse.ArgumentParser(description="GCP IAM Permissions Audit Agent")
    parser.add_argument("--org-id", help="GCP Organization ID")
    parser.add_argument("--project-id", help="GCP Project ID")
    parser.add_argument("--identity", help="Identity to analyze (user:email or serviceAccount:email)")
    parser.add_argument("--output", default="gcp_iam_audit.json")
    parser.add_argument("--action", choices=[
        "primitive_roles", "public_access", "service_accounts",
        "analyze_identity", "full_audit"
    ], default="full_audit")
    args = parser.parse_args()

    scope = f"organizations/{args.org_id}" if args.org_id else f"projects/{args.project_id}"
    report = {"audit_date": datetime.utcnow().isoformat(), "scope": scope, "findings": {}}

    if args.action in ("primitive_roles", "full_audit"):
        primitives = find_primitive_roles(scope)
        report["findings"]["primitive_roles"] = primitives
        print(f"[+] Primitive role bindings: {len(primitives)}")

    if args.action in ("public_access", "full_audit"):
        public = find_public_bindings(scope)
        report["findings"]["public_access"] = public
        print(f"[+] Public access bindings: {len(public)}")

    if args.action in ("service_accounts", "full_audit") and args.project_id:
        sas = list_service_accounts(args.project_id)
        report["findings"]["service_accounts"] = sas
        keys_count = sum(len(sa["user_managed_keys"]) for sa in sas)
        print(f"[+] Service accounts: {len(sas)}, user-managed keys: {keys_count}")

    if args.action == "analyze_identity" and args.identity:
        access = analyze_permissions(scope, args.identity)
        report["findings"]["identity_access"] = access
        print(f"[+] Resources accessible by {args.identity}: {len(access)}")

    with open(args.output, "w") as f:
        json.dump(report, f, indent=2, default=str)
    print(f"[+] Report saved to {args.output}")


if __name__ == "__main__":
    main()

Keep exploring