The GCP Scanner, hosted on GitHub, is a comprehensive tool designed to assess the level of access that specific credentials have on Google Cloud Platform (GCP). This resource scanner is particularly useful for security engineers to evaluate the impact of VM/container compromises, GCP service account leaks, or OAuth2 token key leaks.
GitHub
Category
GCP - IAM
Features
-
Supported GCP Resources:
- GCE, GCS, GKE, App Engine, Cloud SQL, BigQuery
- Spanner, Pub/Sub, Cloud Functions, BigTable, CloudStore, KMS, Cloud Services
-
Credential Support:
- GCP VM instance metadata
- User credentials in gcloud profiles
- OAuth2 Refresh Tokens with cloud-platform scope
- GCP service account keys in JSON format
-
Standalone Tool: Can be used without any third-party tools like gcloud, especially useful on systems without GCP SDK.
-
Customizability: The scanner provides options to scan individual service accounts or projects and includes a configuration path for scanning specific resources.