Multi-cloud asset and audit automation.
A Python tool that collects assets, permissions, and audit logs from AWS, GCP, and Tencent Cloud into one schema, and alerts on risky events.
Problem
Each cloud returns the same concept in a different shape. Comparing permissions or firewalls meant reading three formats by hand.
Approach
Each account is reached through a cross-account role such as STS AssumeRole. Seven collectors, one per resource type, feed a single data class per resource. Output goes to Google Sheets and CSV, and 16 critical events alert Slack and Telegram immediately based on critical_events.yaml.
Implementation
- Python
- boto3
- Google Cloud SDK
- Tencent Cloud SDK
- Google Sheets
- Slack
- Telegram
Scale · 3 clouds · 7 collectors · 49 audit actions
The public code reads assets, permissions, and audit logs from AWS, GCP, and Tencent Cloud.
Each account is reached through a cross-account role, such as STS AssumeRole. No key files are kept.
Seven collectors, one per resource type, gather data the same way.
Different responses are normalized into one data class per resource.
Records go to Google Sheets with headers, filters, and column widths set automatically.
Events listed as critical go straight to Slack and Telegram.
Audit sheets are copied to CSV once a month into year and month folders.
Read every step
- The public code reads assets, permissions, and audit logs from AWS, GCP, and Tencent Cloud.
- Each account is reached through a cross-account role, such as STS AssumeRole. No key files are kept.
- Seven collectors, one per resource type, gather data the same way.
- Different responses are normalized into one data class per resource.
- Records go to Google Sheets with headers, filters, and column widths set automatically.
- Events listed as critical go straight to Slack and Telegram.
- Audit sheets are copied to CSV once a month into year and month folders.
Result
The production tool behind this code checked four clouds including Azure every day before dawn, removed several days of manual month-end review, and together with Terraform defaults and CI gates helped raise the remediation rate from 60% to over 85%.
- 3
- Clouds covered by the public code
- 7
- Collectors by resource type
- 49
- Audit actions tracked (16 alert immediately)
What I learned
When running several clouds together, the biggest cost was not collecting data but people lining up different formats by hand. Collection differs per cloud, but normalizing the results into one data class per resource lets permissions or firewalls be compared in the same columns, and adding a cloud means adding a collector. Keeping the critical event list as data (critical_events.yaml) instead of code mattered too: a security reviewer can read and change the rules without reading Python, and rule changes never mix with code changes. Some paths were verified only with mocks, not live accounts, which taught me that how far automation can be trusted is set by how much of it was actually checked.
3 clouds — 7 collectors, 1 schema
Public repo: pf-05-multicloud-asset-audit-automation ↗