GCP - common misconfigurations
| Misconfiguration | Risk | What to look for |
|---|---|---|
| Public GCS buckets | high | Bucket IAM allows allUsers or allAuthenticatedUsers |
| Service account keys (user-managed) | high | JSON keys created - prefer workload identity instead |
| Broad IAM bindings | high | roles/owner, roles/editor on org/folder/project |
| Public Cloud Functions / Cloud Run | medium | --allow-unauthenticated flag set on deploy |
| Default service account used by compute | medium | GCE instances using the default SA have project-wide Editor |
| Firewall rules open to the world | medium | 0.0.0.0/0 allowed on SSH/RDP/HTTP |
Common tools
| Tool | Purpose |
|---|---|
| scoutsuite | Multi-cloud auditing (GCP supported) |
| gcp_scanner | Enumerate GCP resources for misconfigs |
| GCPBucketBrute | Bruteforce GCS bucket names |
| policyuniverse | Parse and audit GCP IAM policies |
Useful commands
# authenticate
gcloud auth login
# whoami
gcloud config get-value account
# list projects
gcloud projects list
# check if a GCS bucket is public
gsutil iam ch -r allUsers:objectViewer gs://BUCKET-NAME 2>/dev/null
gsutil ls -L -b gs://BUCKET-NAME | grep -A1 ACL
# enumerate service accounts
gcloud iam service-accounts list
# list firewall rules
gcloud compute firewall-rules list
# list GCE instances and their service accounts
gcloud compute instances list --format="table(name,zone,status,serviceAccounts[].email)"