Skip to main content
emisar

Google Cloud Storage diagnostics

v0.1.3

Read-only Cloud Storage diagnostics for buckets, IAM policies, bounded object listings, and fixed object metadata. Object bodies, custom metadata values, contexts, signed URLs, and credential operations are excluded.

5 allowed by default
Pack ID
gcp-storage
Vendor
emisar
OS
linux
Actions
5
Required binaries. Install these on the host before relying on the pack. An action that calls a missing binary fails at run time.
gcloud jq

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below before copying it into the runner's packs dir. That hash covers the exact bytes this page was built from, so a tampered copy is rejected. The command reloads a running daemon itself, so you don't need to restart it manually.

on the runner host 
sudo emisar pack install gcp-storage --hash sha256:f419a54f0148f50dd611c679029129763f90f7cd1102a72490fcf602514ebf3f

Setup

Drives gcloud and projects Cloud Storage API responses locally before they leave the runner. Authenticate gcloud before loading the pack.

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • CLOUDSDK_CONFIG

    Optional gcloud configuration directory.

  • CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE

    Optional credential file that overrides the active gcloud account.

Notes

  • Bucket/object inventory can use roles/storage.bucketViewer plus roles/storage.objectViewer; bucket IAM reads additionally need storage.buckets.getIamPolicy, best supplied through an exact custom read role rather than roles/storage.admin.
  • Actions use mode-0600 temporary response files and remove them before exit.
  • Object actions return metadata only and never fetch object bodies.
  • This remote-target pack declares no host detection signal and is never auto-suggested merely because gcloud is installed.

Verify it works

Runs gcp.storage_buckets, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify gcp-storage

Install and configure a pack walks through the whole sequence on a host.

Actions 5 total

View on GitHub
  • gcp.storage_bucket_describe script low Low: read-only or trivially reversible

    gcloud storage buckets describe

    Show one bucket's location, storage, retention, lifecycle, encryption, access, and namespace configuration.

    View source on GitHub
  • gcp.storage_bucket_policy script low Low: read-only or trivially reversible

    gcloud storage buckets get-iam-policy

    Show one bucket's IAM roles, members, and conditions.

    View source on GitHub
  • gcp.storage_buckets script low Low: read-only or trivially reversible

    gcloud storage buckets list

    List bounded bucket location, storage, retention, lifecycle, encryption, access, and namespace configuration.

    View source on GitHub
  • gcp.storage_object_describe script low Low: read-only or trivially reversible

    gcloud storage objects describe

    Show one object's system metadata and custom metadata keys without its body or custom values.

    View source on GitHub
  • gcp.storage_objects script low Low: read-only or trivially reversible

    List Cloud Storage objects

    List live object metadata under a literal prefix. Set include_versions to include noncurrent generations, marked by timeDeleted; soft-deleted objects are excluded. The limit caps returned rows, not API pages. Custom metadata and context values are omitted.

    View source on GitHub
← Back to registry
Pack reference  Publish your own