Purpose
Use this skill for tightly scoped GCP control-plane validation with approved account or service-account access.
Phase Fit
- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure
Use When
- Need to confirm the effective scope of an approved GCP identity.
- Need to inspect projects, IAM posture, or exposed resources.
- Need a low-impact retest after GCP remediation.
Avoid When
- Project or identity boundaries are unclear.
- Commands would change state without explicit approval.
Inputs
- Approved project or organization scope
- Authorized account or service account
- Read-only versus mutating boundaries
Procedure
- Confirm the active account and project context.
- Query only the services relevant to the current hypothesis.
- Keep validation read-oriented unless stronger actions are explicitly approved.
- Tie material exposure to project and business context.
- Preserve the exact project and identity scope for retest.
Command Syntax
Replace sample projects and resources with approved in-scope values.
# Authenticate
gcloud auth login
# List authenticated accounts
gcloud auth list
# Get current project
gcloud config get-value project
# List all projects
gcloud projects list
# List GCS buckets
gcloud storage buckets list
# List bucket contents
gcloud storage ls gs://contoso-prod-backup --project contoso-prod
# List Compute Engine instances
gcloud compute instances list
# Get IAM policy for a project
gcloud projects get-iam-policy contoso-prod
# List service accounts
gcloud iam service-accounts list
# Access a Secret Manager secret
gcloud secrets versions access latest --secret=db-password
Evidence to Capture
- Effective GCP identity and project scope
- Material resource exposure or IAM boundary issues
- Exact project and account context used
Safety Boundaries
- Default to read-only validation.
- Do not create, modify, or delete resources without explicit written approval.