AuditClaw GCP
Companion skill for auditclaw-grc. Collects compliance evidence from Google Cloud Platform projects using read-only API calls.
12 checks | Viewer + Security Reviewer roles only | Evidence stored in shared GRC database
Security Model
- - Read-only access: Requires 6 read-only IAM roles (Viewer, Security Reviewer, Cloud SQL Viewer, Logging Viewer, DNS Reader, Cloud KMS Viewer). No write/modify permissions.
- Credentials: Uses standard GCP credential chain (
GOOGLE_APPLICATION_CREDENTIALS or gcloud auth). No credentials stored by this skill. - Dependencies: Google Cloud SDK packages (all pinned in requirements.txt)
- Data flow: Check results stored as evidence in
~/.openclaw/grc/compliance.sqlite via auditclaw-grc
Prerequisites
- - GCP credentials configured (
gcloud auth application-default login or service account JSON) - INLINECODE4 environment variable set
- INLINECODE5
- auditclaw-grc skill installed and initialized
Commands
- - "Run GCP evidence sweep": Run all checks, store results in GRC database
- "Check GCP storage compliance": Run Cloud Storage checks
- "Check GCP firewall rules": Run firewall ingress checks
- "Check GCP IAM compliance": Run IAM service account checks
- "Check GCP logging status": Verify audit logging configuration
- "Check GCP KMS keys": Review KMS key rotation
- "Show GCP integration health": Last sync, errors, evidence count
Usage
All evidence is stored in the shared GRC database at ~/.openclaw/grc/compliance.sqlite
via the auditclaw-grc skill's db_query.py script.
To run a full evidence sweep:
CODEBLOCK0
To run specific checks:
CODEBLOCK1
Check Categories (9 files, 12 findings)
| Check | What It Verifies |
|---|
| storage | Uniform bucket-level access, public access prevention |
| firewall |
No unrestricted ingress (0.0.0.0/0) to SSH/RDP/all |
|
iam | Service account key rotation (90 days), SA admin privilege restriction |
|
logging | Audit logging enabled (all services), log export sink exists |
|
kms | KMS key rotation period <= 90 days |
|
dns | DNSSEC enabled on public zones |
|
bigquery | No public dataset access (allUsers/allAuthenticatedUsers) |
|
compute | No default service account with cloud-platform scope |
|
cloudsql | SSL enforcement, no public IP with 0.0.0.0/0 |
Evidence Storage
Each check produces evidence items stored with:
- - INLINECODE6
- INLINECODE7
- INLINECODE8 : Mapped to relevant SOC2/ISO/HIPAA controls
- INLINECODE9 : Human-readable finding summary
- INLINECODE10 : JSON details of the check result
Required IAM Roles
- - INLINECODE11
- INLINECODE12
- INLINECODE13
- INLINECODE14
- INLINECODE15
- INLINECODE16
All checks use read-only access only.
Setup Guide
When a user asks to set up GCP integration, guide them through these steps:
Step 1: Create Service Account
CODEBLOCK2
Step 2: Grant IAM Roles
Grant these 6 read-only roles:
CODEBLOCK3
Step 3: Generate JSON Key
CODEBLOCK4
Step 4: Configure Credentials
Set environment variables:
- - GOOGLEAPPLICATIONCREDENTIALS=/path/to/key.json
- GCPPROJECTID=your-project-id
Step 5: Verify Connection
Run: INLINECODE17
The exact roles are documented in scripts/gcp-roles.json. Show with:
python3 {baseDir}/../auditclaw-grc/scripts/db_query.py --action show-policy --provider gcp
AuditClaw GCP
auditclaw-grc 的配套技能。通过只读 API 调用从 Google Cloud Platform 项目收集合规性证据。
12 项检查 | 仅需 Viewer + Security Reviewer 角色 | 证据存储在共享 GRC 数据库中
安全模型
- - 只读访问：需要 6 个只读 IAM 角色（Viewer、Security Reviewer、Cloud SQL Viewer、Logging Viewer、DNS Reader、Cloud KMS Viewer）。无写入/修改权限。
- 凭据：使用标准 GCP 凭据链（GOOGLEAPPLICATIONCREDENTIALS 或 gcloud auth）。本技能不存储任何凭据。
- 依赖项：Google Cloud SDK 包（全部锁定在 requirements.txt 中）
- 数据流：检查结果通过 auditclaw-grc 作为证据存储在 ~/.openclaw/grc/compliance.sqlite 中
前提条件
- - 已配置 GCP 凭据（gcloud auth application-default login 或服务账号 JSON）
- 已设置 GCPPROJECTID 环境变量
- pip install -r scripts/requirements.txt
- 已安装并初始化 auditclaw-grc 技能
命令
- - 运行 GCP 证据扫描：运行所有检查，将结果存储在 GRC 数据库中
- 检查 GCP 存储合规性：运行 Cloud Storage 检查
- 检查 GCP 防火墙规则：运行防火墙入站检查
- 检查 GCP IAM 合规性：运行 IAM 服务账号检查
- 检查 GCP 日志记录状态：验证审计日志配置
- 检查 GCP KMS 密钥：审查 KMS 密钥轮换
- 显示 GCP 集成健康状态：上次同步、错误、证据数量
使用方法
所有证据通过 auditclaw-grc 技能的 db_query.py 脚本存储在共享 GRC 数据库 ~/.openclaw/grc/compliance.sqlite 中。
运行完整证据扫描：
python3 scripts/gcp_evidence.py --db-path ~/.openclaw/grc/compliance.sqlite --all
运行特定检查：
python3 scripts/gcp_evidence.py --db-path ~/.openclaw/grc/compliance.sqlite --checks storage,firewall,iam
检查类别（9 个文件，12 项发现）
| 检查项 | 验证内容 |
|---|
| storage | 统一存储桶级访问控制、公共访问阻止 |
| firewall |
无对 SSH/RDP/所有端口的无限制入站访问（0.0.0.0/0） |
|
iam | 服务账号密钥轮换（90 天）、SA 管理员权限限制 |
|
logging | 审计日志已启用（所有服务）、日志导出接收器存在 |
|
kms | KMS 密钥轮换周期 <= 90 天 |
|
dns | 公共区域已启用 DNSSEC |
|
bigquery | 无公共数据集访问权限（allUsers/allAuthenticatedUsers） |
|
compute | 无使用 cloud-platform 范围的默认服务账号 |
|
cloudsql | SSL 强制、无使用 0.0.0.0/0 的公共 IP |
证据存储
每项检查生成的证据项存储时包含：
- - source: gcp
- type: automated
- controlid：映射到相关的 SOC2/ISO/HIPAA 控制项
- description：人类可读的发现摘要
- filecontent：检查结果的 JSON 详情
所需 IAM 角色
- - roles/viewer
- roles/iam.securityReviewer
- roles/cloudsql.viewer
- roles/logging.viewer
- roles/dns.reader
- roles/cloudkms.viewer
所有检查仅使用只读访问权限。
设置指南
当用户要求设置 GCP 集成时，引导他们完成以下步骤：
步骤 1：创建服务账号
gcloud iam service-accounts create auditclaw-scanner --display-name=AuditClaw Scanner
步骤 2：授予 IAM 角色
授予以下 6 个只读角色：
for role in roles/viewer roles/iam.securityReviewer roles/cloudsql.viewer roles/logging.viewer roles/dns.reader roles/cloudkms.viewer; do
gcloud projects add-iam-policy-binding PROJECT_ID \
--member=serviceAccount:auditclaw-scanner@PROJECT_ID.iam.gserviceaccount.com \
--role=$role
done
步骤 3：生成 JSON 密钥
gcloud iam service-accounts keys create key.json --iam-account=auditclaw-scanner@PROJECT_ID.iam.gserviceaccount.com
步骤 4：配置凭据
设置环境变量：
- - GOOGLEAPPLICATIONCREDENTIALS=/path/to/key.json
- GCPPROJECTID=your-project-id
步骤 5：验证连接
运行：python3 {baseDir}/scripts/gcp_evidence.py --test-connection
具体角色记录在 scripts/gcp-roles.json 中。使用以下命令查看：
python3 {baseDir}/../auditclaw-grc/scripts/db_query.py --action show-policy --provider gcp
