$ gcphelpit checks
gcphelpit check catalog
Every built-in check gcphelpit runs: its ID, severity, the issue it flags, a plain-English fix, and an authoritative Google Cloud reference. 16 checks across 4 categories.
What is gcphelpit?
gcphelpit is a free, open-source Python CLI that scans a JSON snapshot of a Google Cloud project for security, IAM, cost, and reliability issues in one pass, and each finding comes with a plain-English fix. It is mock-first: it reads an exported snapshot, so it runs with no live cloud access or credentials. See the tool page to install and run it, or how it compares to other GCP scanners.
🔒 Security checks
| ID | Severity | What it flags | How to fix | Reference |
|---|---|---|---|---|
SEC001 | HIGH | Cloud Storage bucket is publicly accessible | Remove allUsers/allAuthenticatedUsers from the bucket IAM policy and turn on public access prevention. |
Bucket access control |
SEC002 | MEDIUM | Bucket has uniform bucket-level access disabled | Enable uniform bucket-level access so legacy ACLs can't grant unintended access. | Uniform bucket-level access |
SEC003 | HIGH | Firewall rule opens a sensitive port to the internet | Restrict the source range from 0.0.0.0/0 to known IPs; keep ports like 22/3389 off the public internet. |
VPC firewall rules |
SEC004 | HIGH | Cloud SQL instance has a public IP | Disable the public IP and connect over Private IP or the Cloud SQL Auth Proxy. | Configure private IP |
SEC005 | MEDIUM | Cloud SQL does not require SSL/TLS | Require SSL/TLS for all connections to the instance. | Configure SSL/TLS |
👤 IAM checks
| ID | Severity | What it flags | How to fix | Reference |
|---|---|---|---|---|
IAM001 | HIGH | Primitive role (owner/editor) granted to a user | Replace owner/editor with a least-privilege predefined or custom role. |
Least privilege |
IAM002 | HIGH | Service account granted owner/editor at the project level | Grant the service account only the specific roles it needs, not owner/editor. | Service-account best practices |
IAM003 | MEDIUM | External (non-organization) member has access | Remove external members, or restrict allowed domains with a domain-restriction org policy. | Restrict domains |
IAM004 | MEDIUM | Service account has user-managed keys | Delete user-managed keys; use workload identity or short-lived credentials instead. | Manage SA keys |
💸 Cost checks
| ID | Severity | What it flags | How to fix | Reference |
|---|---|---|---|---|
COST001 | LOW | Unattached persistent disk | Delete or snapshot the unattached disk so you stop paying for idle storage. | Persistent disks |
COST002 | LOW | Reserved static IP address is unused | Release the reserved static IP that isn't attached to any resource. | Static external IPs |
COST003 | LOW | Instance stopped but disks still allocated | Delete the stopped VM's disks (or the VM) if they're no longer needed. Stopped VMs still bill for disks. | Instance life cycle |
COST004 | MEDIUM | No budget alert configured for the project | Create a budget with alert thresholds so spend surprises are caught early. | Create budgets |
🛟 Reliability checks
| ID | Severity | What it flags | How to fix | Reference |
|---|---|---|---|---|
REL001 | HIGH | Cloud SQL instance has no automated backups | Enable automated backups (and point-in-time recovery) on the instance. | Backups |
REL002 | LOW | Instance has deletion protection disabled | Enable deletion protection on production instances to prevent accidental deletion. | Deletion protection |
REL003 | MEDIUM | Cloud SQL instance is not highly available (single zone) | Enable high availability (regional) so the database survives a zone outage. | High availability |
Every finding comes with the fix. gcphelpit reports the exact resource plus the recommendation above.
Install gcphelpit and run
gcphelpit scan, or see how it
compares to Prowler, ScoutSuite & gcp-auditor.