Skip to main content
emisar

Google Cloud Storage diagnostics

v0.1.2

Read-only Cloud Storage diagnostics for buckets, IAM policies, bounded object listings, and fixed object metadata. Object bodies, custom metadata values, contexts, signed URLs, and credential operations are excluded.

5 allowed by default
Pack ID
gcp-storage
Vendor
emisar
OS
linux
Actions
5
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
gcloud jq

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install gcp-storage --hash sha256:26905f56cc3271616a5d1168ecf7aaa777ec09930f1940ab54a695de352f17ac

Setup

Drives gcloud and projects Cloud Storage API responses locally before they leave the runner. Authenticate gcloud before loading the pack.

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • CLOUDSDK_CONFIG

    Optional gcloud configuration directory.

  • CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE

    Optional credential file that overrides the active gcloud account.

Notes

  • Bucket/object inventory can use roles/storage.bucketViewer plus roles/storage.objectViewer; bucket IAM reads additionally need storage.buckets.getIamPolicy, best supplied through an exact custom read role rather than roles/storage.admin.
  • Actions use mode-0600 temporary response files and remove them before exit.
  • Object actions return metadata only and never fetch object bodies.
  • This remote-target pack declares no host detection signal and is never auto-suggested merely because gcloud is installed.

Verify it works

Runs gcp.storage_buckets, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify gcp-storage

Install and configure a pack walks through the whole sequence on a host.

Actions 5 total

View on GitHub
  • gcp.storage_bucket_describe script low Low — read-only or trivially reversible

    gcloud storage buckets describe

    Show one bucket's location, storage, retention, lifecycle, encryption, access, and namespace configuration.

    View source on GitHub
  • gcp.storage_bucket_policy script low Low — read-only or trivially reversible

    gcloud storage buckets get-iam-policy

    Show one bucket's IAM roles, members, and conditions.

    View source on GitHub
  • gcp.storage_buckets script low Low — read-only or trivially reversible

    gcloud storage buckets list

    List bounded bucket location, storage, retention, lifecycle, encryption, access, and namespace configuration.

    View source on GitHub
  • gcp.storage_object_describe script low Low — read-only or trivially reversible

    gcloud storage objects describe

    Show one object's system metadata and custom metadata keys without its body or custom values.

    View source on GitHub
  • gcp.storage_objects script low Low — read-only or trivially reversible

    gcloud storage objects list

    List bounded object system metadata under a literal prefix without custom metadata values.

    View source on GitHub
← Back to registry
Pack reference  Publish your own