gcp

Documentation

Index

• func ScannerCount() int
• type BindingScanner
  • func NewBindingScanner(api ResourceManagerAPI, project string) *BindingScanner
  • func (s *BindingScanner) Scan(ctx context.Context, cfg iam.ScanConfig) (*iam.ScanResult, error)
  • func (s *BindingScanner) Type() iam.ResourceType
• type Client
  • func NewClient(ctx context.Context, project string) (*Client, error)
  • func NewClientWith(project string, iamAPI IAMAPI, crmAPI ResourceManagerAPI) *Client
• type GCPScanner
  • func NewGCPScanner(client *Client, scanCfg iam.ScanConfig) *GCPScanner
  • func (s *GCPScanner) ScanAll(ctx context.Context) (*iam.ScanResult, error)
• type IAMAPI
• type ResourceManagerAPI
• type ServiceAccountScanner
  • func NewServiceAccountScanner(api IAMAPI, project string) *ServiceAccountScanner
  • func (s *ServiceAccountScanner) Scan(ctx context.Context, cfg iam.ScanConfig) (*iam.ScanResult, error)
  • func (s *ServiceAccountScanner) Type() iam.ResourceType

Functions

func ScannerCount

func ScannerCount() int

ScannerCount returns the number of scanners used.

Types

type BindingScanner

type BindingScanner struct {
	// contains filtered or unexported fields
}

BindingScanner detects overprivileged service account IAM bindings.

func NewBindingScanner

func NewBindingScanner(api ResourceManagerAPI, project string) *BindingScanner

NewBindingScanner creates a scanner for GCP IAM bindings.

func (*BindingScanner) Scan

func (s *BindingScanner) Scan(ctx context.Context, cfg iam.ScanConfig) (*iam.ScanResult, error)

Scan examines project IAM bindings for overprivileged service accounts.

func (*BindingScanner) Type

func (s *BindingScanner) Type() iam.ResourceType

Type returns the resource type this scanner handles.

type Client

type Client struct {
	IAM             IAMAPI
	ResourceManager ResourceManagerAPI
	Project         string
}

Client wraps GCP API clients.

func NewClient

func NewClient(ctx context.Context, project string) (*Client, error)

NewClient creates a GCP client for the given project.

func NewClientWith

func NewClientWith(project string, iamAPI IAMAPI, crmAPI ResourceManagerAPI) *Client

NewClientWith creates a client with custom API implementations (for testing).

type GCPScanner

type GCPScanner struct {
	// contains filtered or unexported fields
}

GCPScanner orchestrates all GCP IAM scanners.

func NewGCPScanner

func NewGCPScanner(client *Client, scanCfg iam.ScanConfig) *GCPScanner

NewGCPScanner creates an orchestrator for GCP IAM scanning.

func (*GCPScanner) ScanAll

func (s *GCPScanner) ScanAll(ctx context.Context) (*iam.ScanResult, error)

ScanAll runs all GCP IAM scanners and returns combined results.

type IAMAPI

type IAMAPI interface {
	ListServiceAccounts(ctx context.Context, project string) ([]*iamv1.ServiceAccount, error)
	ListServiceAccountKeys(ctx context.Context, serviceAccountName string) ([]*iamv1.ServiceAccountKey, error)
}

IAMAPI defines the GCP IAM operations needed for scanning.

type ResourceManagerAPI

type ResourceManagerAPI interface {
	GetIamPolicy(ctx context.Context, project string) (*crmv1.Policy, error)
}

ResourceManagerAPI defines the GCP Resource Manager operations needed.

type ServiceAccountScanner

type ServiceAccountScanner struct {
	// contains filtered or unexported fields
}

ServiceAccountScanner detects stale service accounts and stale service account keys.

func NewServiceAccountScanner

func NewServiceAccountScanner(api IAMAPI, project string) *ServiceAccountScanner

NewServiceAccountScanner creates a scanner for GCP service accounts.

func (*ServiceAccountScanner) Scan

func (s *ServiceAccountScanner) Scan(ctx context.Context, cfg iam.ScanConfig) (*iam.ScanResult, error)

Scan examines service accounts and their keys for staleness.

func (*ServiceAccountScanner) Type

func (s *ServiceAccountScanner) Type() iam.ResourceType

Type returns the resource type this scanner handles.