mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-02 17:03:25 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
79 lines
2.2 KiB
Markdown
79 lines
2.2 KiB
Markdown
# API Reference: Auditing GCP IAM Permissions
|
|
|
|
## google-cloud-asset
|
|
|
|
### Search All IAM Policies
|
|
|
|
```python
|
|
from google.cloud import asset_v1
|
|
|
|
client = asset_v1.AssetServiceClient()
|
|
request = asset_v1.SearchAllIamPoliciesRequest(
|
|
scope="organizations/ORG_ID",
|
|
query="policy:roles/owner",
|
|
page_size=500,
|
|
)
|
|
for result in client.search_all_iam_policies(request=request):
|
|
print(result.resource, result.policy.bindings)
|
|
```
|
|
|
|
### Analyze IAM Policy (Who Can Access What)
|
|
|
|
```python
|
|
request = asset_v1.AnalyzeIamPolicyRequest(
|
|
analysis_query=asset_v1.IamPolicyAnalysisQuery(
|
|
scope="organizations/ORG_ID",
|
|
identity_selector=asset_v1.IamPolicyAnalysisQuery.IdentitySelector(
|
|
identity="user:dev@company.com"
|
|
),
|
|
)
|
|
)
|
|
response = client.analyze_iam_policy(request=request)
|
|
```
|
|
|
|
## google-cloud-iam (Service Accounts)
|
|
|
|
```python
|
|
from google.cloud import iam_admin_v1
|
|
|
|
client = iam_admin_v1.IAMClient()
|
|
|
|
# List service accounts
|
|
request = iam_admin_v1.ListServiceAccountsRequest(name="projects/PROJECT_ID")
|
|
for sa in client.list_service_accounts(request=request):
|
|
print(sa.email, sa.disabled)
|
|
|
|
# List user-managed keys
|
|
key_req = iam_admin_v1.ListServiceAccountKeysRequest(
|
|
name=sa.name,
|
|
key_types=[iam_admin_v1.ListServiceAccountKeysRequest.KeyType.USER_MANAGED],
|
|
)
|
|
```
|
|
|
|
## google-cloud-resource-manager
|
|
|
|
```python
|
|
from google.cloud import resourcemanager_v3
|
|
|
|
client = resourcemanager_v3.ProjectsClient()
|
|
policy = client.get_iam_policy(request={"resource": "projects/PROJECT_ID"})
|
|
for binding in policy.bindings:
|
|
print(binding.role, list(binding.members))
|
|
```
|
|
|
|
## Key GCP IAM Roles to Flag
|
|
|
|
| Role | Risk Level |
|
|
|------|-----------|
|
|
| `roles/owner` | Critical (full control) |
|
|
| `roles/editor` | High (write access all services) |
|
|
| `roles/iam.serviceAccountTokenCreator` | High (impersonation) |
|
|
| `roles/iam.serviceAccountKeyAdmin` | High (key creation) |
|
|
|
|
### References
|
|
|
|
- google-cloud-asset: https://pypi.org/project/google-cloud-asset/
|
|
- google-cloud-iam: https://pypi.org/project/google-cloud-iam/
|
|
- google-cloud-resource-manager: https://pypi.org/project/google-cloud-resource-manager/
|
|
- GCP IAM docs: https://cloud.google.com/iam/docs
|