gcp-ironcladlisted

# GCP API-Key Ironclad — Driver ## Overview Orchestrates the full audit-and-harden flow for GCP API keys. Runs two READ-ONLY sub-skills in parallel, gates on an "active spike" check, then runs two APPLY sub-skills, then assembles a single markdown + JSON final report. Every applied change is idempotent and reversible. ## When to Use - After any suspected leaked-key incident, to confirm cleanup and lock down what's left. - As a recurring hygiene pass (every 30 days, say) on a GCP organization. - For a new GCP user who wants strong defaults established once and verifiable. ## Inputs / flags | Flag | Default | Meaning | |---|---|---| | `--dry-run` | off | Run every phase, mutate nothing | | `--confirm-each` | off | Prompt y/n before every applied action | | `--lookback-days` | 60 | Anomaly-scan window | | `--threshold-pct` | 200 | Anomaly threshold (% over 7d rolling avg) | | `--active-spike-multiple` | 10 | Multiple above baseline in last 24h that triggers the halt | ## Phases ### Phase 0 — Discover scope ```bash SESSION_DIR="/tmp/gcp-ironclad/$(date -u +%Y-%m-%dT%H-%M-%SZ)" mkdir -p "${SESSION_DIR}" gcloud auth application-default print-access-token >/dev/null # ADC sanity check USER=$(gcloud config get-value account) gcloud projects list --format=json > "${SESSION_DIR}/raw-projects.json" gcloud billing accounts list --format=json > "${SESSION_DIR}/raw-billing.json" jq -n --arg u "$USER" \ --slurpfile p "${SESSION_DIR}/raw-projects.json" \ --slurpfile b