GCP Risk Analyzer

Why I built it

I built GCP Risk Analyzer because cloud risk often appears as configuration drift: public access, primitive roles, missing key controls, or managed notebook exposure. I wanted a small CLI that could make those issues visible without requiring a dashboard or long setup flow.

I focused on understandable findings over broad cloud inventory coverage. The tool audits selected risks in Vertex AI, Cloud Storage, and IAM, then prints a prioritized report that can be read locally and later wired into automation.

What it does

The tool runs against a Google Cloud project and reports findings with severity, check name, and message. I exposed direct CLI usage through python -m gcp_risk_analyzer and programmatic usage through GCPRiskAnalyzer(project_id).run_all_checks().

The current documented checks include public Vertex AI notebooks, unrestricted proxy access, public Cloud Storage posture, missing bucket customer-managed KMS keys, public IAM bindings, primitive owner/editor roles, and service accounts holding owner/editor roles.

Technical shape

The project is a Python 3.11+ package with a pyproject.toml and a src/gcp_risk_analyzer/ layout. Core modules include analyzer.py, reporter.py, and models/finding.py.

The audit path I built: authenticate once, run explicit checks, normalize findings, then print a severity-ranked report.

Authentication uses google.auth.default, so setup relies on Google’s application-default credential flow rather than custom credential storage. The repository documents gcloud auth application-default login, a GCP_PROJECT_ID environment variable, required APIs for notebooks, storage, and cloud resource manager, plus roles/viewer and roles/iam.securityReviewer permissions.

The CI pipeline runs Bandit SAST, Safety dependency scanning, and pytest with a minimum 70% coverage threshold.

How a finding becomes useful

I wanted the output to feel like a checklist a security-minded engineer could act on, not a vague cloud score. Each check needs to answer a narrow question, normalize the result into the same finding shape, and then let severity ordering do the first layer of triage.

The decision tree I built around: authenticate once, branch into explicit service checks, normalize the result, and print the risks in a useful order.

That is also why I kept automatic remediation out of scope. For this version, I would rather be precise about what I found than pretend the tool knows enough context to safely change someone else’s cloud project.

Key implementation decisions

• I kept findings explicit and severity-ranked instead of hiding risks behind a generic score.
• I used Google’s default authentication path instead of creating a credential format.
• I split analysis and reporting so future output formats can be added cleanly.
• I ran security scans before tests in CI so the project practices the same discipline it encourages.

Current status

GCP Risk Analyzer is an open-source CLI with source available and no live site. I keep the verified scope to selected checks across Vertex AI, Cloud Storage, and IAM; I do not describe it as exhaustive GCP coverage.

The project reports risks. I did not build automatic remediation into the verified version.

What I would improve next

I would add JSON and CSV output, exit codes for CI gates, and remediation hints per finding. Future checks could cover VPC Service Controls, Cloud Logging audit posture, and Security Command Center integration, but those are not current shipped behavior in the available evidence.