GCP Security Audit · PipelineAtlas

How to create credentials Create a Service Account in your GCP project with the Security Reviewer and Viewer roles. Generate a JSON key file and paste the contents below. Your credentials are used only to run the audit and are never stored.

GCP Project

Project ID Found in the GCP Console header or under IAM and Admin : Settings

Service Account Credentials

Service Account JSON Key Paste the full contents of your downloaded service account JSON key file

Report Delivery

Email Address (optional) Receive the full HTML report by email when the audit completes

Build Your Audit Package

Pick the scanners you want Select the Google Cloud services you run from the scanners below. When you build your package, every scanner you tick runs against your project and the results are combined into a single prioritised report. Choose all of them, or just the services you actually run.

20 of 20 scanners selected

Storage and Data

Cloud Storage

Public access, uniform bucket access, versioning, IAM bindings, access logging

Cloud SQL

Public IP, SSL enforcement, automated backups, PITR, authorized networks

BigQuery

Public dataset access, customer-managed encryption, table expiration policies

Cloud Spanner

CMEK encryption, database audit logging, public IAM bindings

Firestore

CMEK, delete protection, point-in-time recovery, security rules

Compute and Serverless

Compute Engine

Public IPs, OS Login, serial port access, Secure Boot, full API scope

GKE Kubernetes

Legacy ABAC, basic auth, private nodes, network policy, Workload Identity

Cloud Run

Unauthenticated invocations, ingress settings, VPC connector, service account

Cloud Functions

Deprecated runtimes, ingress settings, service account, VPC connector

Artifact Registry

CMEK, immutable tags, public repository access

Security and Identity

IAM

Primitive roles, service account key rotation, public project bindings

Secret Manager

Automatic rotation, public IAM bindings, secrets inventory

Cloud KMS

Key rotation period, public IAM bindings, CMEK coverage

Networking and Edge

VPC Firewall

SSH/RDP open to internet, all-traffic rules, default network existence

Cloud DNS

DNSSEC on public zones, weak signing algorithms

Cloud Armor

WAF policies on backends, default deny, rate limiting, request logging

Messaging and Cache

Pub/Sub

Topic CMEK, public IAM bindings, dead letter topics, ack deadlines

Memorystore Redis

AUTH enabled, transit encryption, Redis version, connectivity mode

Logging and Monitoring

Cloud Logging

Audit log configuration, log sinks, security event metrics and alerts

Cloud Monitoring

Alert policies for IAM, firewall, and network changes, notification channels

Extended Service Coverage

These extended scanners cover the long tail of Google Cloud services. They are optional and unchecked by default to keep a standard audit fast. Tick only what you run.

Extended Compute and Serverless

Cloud Run Jobs

Service account, CMEK

App Engine Services

Ingress, traffic split

Cloud Workstations

Private cluster, CMEK

Cloud Batch

Job state, service account

VMware Engine

Management access, state

Cloud TPU

External IPs, health

Instance Templates

Shielded VM, IP forwarding, scopes

Machine Images

CMEK

Extended Observability

Log Sinks

Export destination, filters

Log Buckets

Retention, CMEK, locking

Log-Based Metrics

Security metric coverage

Uptime Checks

TLS validation on checks

Alerting Policies

Enabled state, notification channels

Notification Channels

Verified channels