gcp

Identify IAM misconfigurations, insecure bindings, and risky service accounts in Google Cloud Platform deployments.

Updated Aug 23, 2026

Search Tags:#security #gcp #governance #iam #network #cloud-security #cloud-audit

Ready to run

npx skills add https://github.com/curphey/bosun --skill gcp-curphey

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: gcp
Source: https://github.com/curphey/bosun/tree/main/skills/gcp
Command: npx skills add https://github.com/curphey/bosun --skill gcp-curphey

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

GCP infrastructure security reviews help teams quickly identify misconfigurations in IAM, network controls, data protection, and governance that could expose workloads or compromise data.

Core Features & Use Cases

IAM security checks: avoid primitive roles, enforce dedicated service accounts, remove public bindings, and apply conditional access where supported.
Network and data protection checks: review firewall rules, Private Access, encryption, and storage policies to minimize exposure and data leakage.
Governance and policy alignment: ensure organization policies and folders enforce security constraints across projects and resources.

Quick Start

Run a comprehensive GCP security review on your project to identify IAM misconfigurations, insecure network configurations, and data-protection gaps.

Frequently Asked Questions about gcp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check for IAM misconfigurations and risky service accounts in GCP?▼

To check for IAM misconfigurations in GCP, scan your deployments for primitive roles, public bindings, and risky service accounts. This enforces dedicated identities and conditional access to minimize exposure.

What is the best way to audit GCP network and data protection controls?▼

Auditing GCP network and data protection involves reviewing firewall rules, Private Google Access, encryption configurations, and storage policies to minimize external exposure and prevent data leakage.

How do I enforce security constraints across GCP organization policies and folders?▼

Enforce security constraints across GCP by applying organization policies that mandate security boundaries across folders, projects, and resources to maintain governance and compliance alignment.

Does GCP security review cover public access and primitive role bindings?▼

Yes, GCP security reviews explicitly check for public access bindings and primitive roles to identify over-permissioned accounts and guide remediation towards least-privilege access.

How do I remediate insecure IAM bindings and enforce governance in Google Cloud Platform?▼

Remediate insecure IAM bindings in Google Cloud Platform by removing public access, enforcing dedicated service accounts, and applying organization-level constraints to guide governance.