Skip to content

Add gcp-project-configuration-audit CodeBundle - #755

Open
rw-codebundle-agent[bot] wants to merge 2 commits into
mainfrom
codebundle/gcp-project-configuration-audit
Open

Add gcp-project-configuration-audit CodeBundle#755
rw-codebundle-agent[bot] wants to merge 2 commits into
mainfrom
codebundle/gcp-project-configuration-audit

Conversation

@rw-codebundle-agent

Copy link
Copy Markdown
Contributor

Closes #179

Implements a new GCP CodeBundle that audits a project's configuration for security and operational risks:

  • Analyze PERMISSION_DENIED Events: Queries Cloud Logging for denied admin activity over a configurable lookback window, flagging high volumes or repeated denied actions.
  • Detect IAM Policy Changes: Inspects SetIamPolicy audit events, highlighting privileged-role changes for review.
  • Analyze Org Policy Constraint Violations: Enumerates effective org policies and reports unsafe constraint states (e.g. public bucket access, disabled service usage).
  • Verify Cloud Audit Log Configuration: Ensures admin/data/policy-denied audit modes and a log sink exist, flagging coverage gaps.
  • Generate Audit Summary Report: Aggregates findings into a consolidated project risk snapshot.

Includes an in-repo sli.robot (0-1 health score), generation rules with - type: sli, SLX/taskset/SLI templates, README, and test infrastructure.

Follows the attached design spec (#179). All tasks are read-only using gcloud.

Audits a GCP project's configuration for security and operational risks:
analysis of PERMISSION_DENIED events, IAM policy changes over a lookback
window, org policy constraint violations, and audit log configuration.

Co-authored-by: rw-codebundle-agent[bot] <rw-codebundle-agent[bot]@users.noreply.github.com>
@rw-codebundle-agent
rw-codebundle-agent Bot requested a review from a team as a code owner August 11, 2026 03:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants