Collection of Bash and Perl scripts that work together with the Google Cloud Platform Policy Analyzer to detect unused Service Accounts (SA) or Service Account Keys (SAK) in large Google Cloud organizations with many projects. Tested and used within Google Cloud organizations of DAX companies.

1. Create list with projects:

   bash 1_projects.sh

   All projects to which the user has access are saved to projects.csv. The CSV list can be adjusted manually. These projects will be used in the next steps.
2. Enable "Policy Analyzer" API:

   bash 2_enable-api.sh

3. Get SA and SAK authentications:

   bash 3_get.sh

4. Create overview for evaluation:

   bash 4_query.sh

   CSV export auth.csv is created. You can import this file into your favorite spreadsheet program.

A few evaluation tips:

Service account keys could pose a security risk if compromised. More than one user managed key (CSV column: userManaged) is not a good idea.

A Bash shell, Perl, SQLite and a few other tools that are included in many standard GNU/Linux distributions. In addition, you need the Google Cloud CLI gcloud which is very easy to install.

sudo apt install     \
  libjson-xs-perl    \
  libdbd-sqlite3-perl

brew install perl
brew install cpanminus pkg-config
brew install sqlite3
brew install --cask google-cloud-sdk

cpanm --installdeps .

All files in this repository are under the Apache License, Version 2.0 unless noted otherwise.