Dollhouse does Incident response and audit on Google Cloud Platform (GCP). As there are many components in GCP, dollhouse aims to be the one tool that can audit the whole platform and give almost real-time alerts to you. It can be used by Security Engineers and DevOps engineers to monitor the whole organization infrastucture. Dollhouse can also send alerts based on pre-configured events.
- Firewall Rules
- IAM Roles
- Service Accounts
- Google Cloud Storage
- An IAM account with Org level permissions :
- roles/iam.securityReviewer
- Viewer
pip install requirements-audit.txt
usage: dollhouse-audit.py [-h] [--account ACCOUNT] [--es ELASTICSEARCH]
[--firewall] [--iam] [--project PROJECT]
[--firewall_name FIREWALL_NAME]
GCP Audit Tool
optional arguments:
-h, --help show this help message and exit
--account ACCOUNT account to run this tool with -> ex: [email protected]
--es ELASTICSEARCH formats to json and pushes to elastic search
--firewall run firewall rules check
--iam run IAM Users & Service Accounts check
--project PROJECT query specific project
--firewall_name FIREWALL_NAME query specific firewall name
python dollhouse-audit.py --account [email protected] --firewall --iam
You can also query specific firewall name on a specific project
python dollhouse-audit.py --account [email protected] --project myProject --firewall_name myfirewallName
Results can be pushed to ElasticSearch for data storing
python dollhouse-audit.py --account [email protected] --firewall --iam --ES 127.0.0.1
Dollhouse-bot is a slack bot which gives instant alerts on slack to custom events that you have set. This bot leverages Google Stackdriver Logging & Monitoring to check for events in a GCP Project.
pip install requirements-bot.txt
- Gcloud account with the following permissions:
- Logs Configuration Writer
- Monitoring Editor
- Service Usage Consumer
You can refer to the following page to get you started with building your slack bot application.
On utils/config.property, input the values for the following variables:
- elasticsearch_host
- elasticsearch_port
- dollhouse_bot_token (Bot User OAuth Access Token)
- EXAMPLE_COMMAND, IAM_ROLE_DESCRIBE_COMMAND, SERVICEACCONT_IDENTIFY_COMMAND, HELP_COMMAND (change it with the ID of your bot)
- running_account
- SLACK_CHANNEL (channel ID which dollhouse-bot will send alerts to)
Each project will have their account. This has to be done from the console or you can enable it while using terraform. Enable Stackdriver API by clicking the hamburger button on the top left, and go to stackdriver monitoring, follow the steps there. You can organize your stackdriver accounts by adding all projects into one stackdriver workspace, so that logs from all the projects goes into one workspace.
The below service apis need to be enabled
logging.googleapis.com Stackdriver Logging API
monitoring.googleapis.com Stackdriver Monitoring API
stackdriver.googleapis.com Stackdriver API
stackdriverprovisioning.googleapis.com Stackdriver Provisioning Service
enable it running the following command
gcloud services enable [service_name]
You can deploy this automatically using dollhouse-deploy script. First, you must write custom logging metrics to that project.
python dollhouse-deploy.py -p projectName -d ./ --logserviceAccount --logfirewall --logiam
At this point, your project should have filtered out custom logs.
Note: Stackdriver and GCP needs to sync for a minute or two.
Once stackdriver monitoring has been set up, we can deploy stackdriver policies and create a slack notification
Make sure you have a slack token and a slack channel. Example can be seen at slack_notification.json
file. The alerts sent from stackdriver will not be look at by us because it does not give enough information. Only the bot looks at the alerts from here. You can name your channel to stackdriver-ignore
. Invite dollhouse-bot to that channel. It will listen and parse the alerts and send it to the actual channel you specified on utils/config.property
.
To deploy policies and slack channel:
python dollhouse-bot.py --createslack --stackdriverfirewall --stackdriverserviceAccount --stackdriveriam
To run dollhouse-bot, you can simply do
python dollhouse-bot.py
- GO-JEK Security Team
- We continuously trying to improve on the code quality of the tool to make it more modular and maintainable.
- Incident Response on GCS bucket
- Whitelisting/Blacklisting alert rules from slack