GCP CNAPP Scanner

01Overview

GCP CNAPP Security Scanner is a single, offline tool that mimics a modern Cloud-Native Application Protection Platform for Google Cloud, collapsing five distinct security disciplines - CSPM, CIEM, CWPP, KSPM, and IaC scanning - into one Python scanner. Instead of connecting to a live project, it reads standard JSON configuration exports produced by the gcloud CLI, gsutil, bq, and Terraform, then audits them against the CIS Google Cloud Foundation Benchmark v2.0, the CIS GKE Benchmark, and Google Cloud best practices.

The scanner ships 67 concrete checks organized into 15 audit modules spanning IAM and org policy, VPC and firewall exposure, Compute Engine, Cloud Storage, Cloud SQL, logging and monitoring, BigQuery, service-account hygiene, entitlement/least-privilege analysis, GKE hardening, serverless and container security, KMS encryption, and Terraform state misconfiguration. Each finding carries a severity, category, CIS mapping, affected resource list, and specific remediation, and the run rolls up into a self-contained interactive HTML dashboard with a weighted risk score and severity/category breakdowns.

It is built for cloud security engineers, GCP platform teams, auditors, and consultants who need a fast, air-gapped posture review without deploying an agent, paying for a SaaS CNAPP, or granting a third party live access to their environment. Because it runs purely on exported JSON, it is safe for authorized assessments in restricted or regulated environments.

What makes it notable: zero external dependencies (pure Python 3.8+ standard library), a clean data-loader that tolerates alternate export filenames, and honest CNAPP-pillar coverage - the same conceptual surface (misconfiguration, identity risk, workload hardening, Kubernetes posture, and shift-left IaC) that commercial platforms charge for, delivered as ~1,800 lines of readable, auditable code.

02Key Capabilities

03Architecture

The scanner is a linear pipeline: a DataLoader ingests exported GCP JSON, 15 auditor engines (each subclassing a common BaseAuditor) evaluate their domain and emit structured findings through a single finding() contract, and a ReportGenerator renders the aggregated findings into an interactive HTML dashboard. All auditors share the same finding schema (id, severity, category, CIS mapping, affected items, remediation), so the CLI can run any subset, filter by severity, and roll everything into one weighted risk report.

04Project Structure

05Security Controls

06Technology Stack

Language

Python 3.8+

Dependencies

Zero external - pure standard library (json, csv, datetime, pathlib, html, argparse)

Input formats

gcloud/gsutil/bq JSON exports and Terraform state/plan JSON

Reporting

Self-contained interactive HTML dashboard (JSON fallback)

Architecture

BaseAuditor + 15 pluggable auditor engines dispatched via MODULE_MAP

Testing

Runnable sample_data corpus of 19 seeded-misconfiguration exports (no formal unit-test suite)

License

MIT

07Quick Start

$ git clone https://github.com/Krishcalin/GCP-CNAPP-Security-Scanner.git && cd GCP-CNAPP-Security-Scanner
$ python gcp_scanner.py --data-dir ./sample_data --output report.html  # run all 15 modules on demo data
$ python gcp_scanner.py --data-dir ./exports --modules iam network compute gke  # scan selected pillars
$ python gcp_scanner.py --data-dir ./exports --severity HIGH  # show only HIGH-and-above findings
$ gcloud projects get-iam-policy PROJECT_ID --format=json > exports/iam_policy.json  # example export before scanning
$ python gcp_scanner.py --data-dir ./exports --modules ciem sa  # CIEM/entitlement-only review

08Compliance & Frameworks

09Integrations & Outputs