Multi-cloud asset and audit automation Design and implementation

A Python tool that collects assets, permissions, and audit logs from AWS, GCP, and Tencent Cloud into one schema, and alerts on risky events.

Audit sheets are copied to CSV once a month into year and month folders.

Only events on the list go to Slack and Telegram right away.

GCP and Tencent are checked the same way for idle IPs, disks, and firewalls.

One schema per resource

What this code does: A data class for IAM data that lines up account information from the three clouds in the same fields: cloud, project, user, group, permission, creation time, access key, last login, and password change time. frozen=True makes each record immutable once created, and the sheet value “IAM” sets the sheet it exports to. Collection code differs per cloud, but because every result lands in this shape, the permissions of all three clouds can be compared side by side in one table.

@dataclass(frozen=True)
class IamRecord(Record):
    sheet: ClassVar[str] = "IAM"
    cloud: str
    project: str
    project_id: str
    user_name: str
    user_id: str
    user_group: str = ""
    permission: str = ""
    user_creation_time: str = ""
    access_key: str = ""
    access_key_creation_time: str = ""
    last_login: str = ""
    password_last_changed: str = ""

Critical events as data

What this code does: A settings file that lists high-risk events per cloud by name (excerpt). High-impact actions such as attaching policies, creating keys, stopping or deleting servers, and changing machine types appear under aws, gcp, and tencent with each cloud’s own event names, and when a collected audit event matches the list, Slack and Telegram are alerted at once. Because the list lives outside the code, changing a rule never requires touching Python.

aws:
  - AttachUserPolicy
  - CreateAccessKey
  - StopInstances
  - TerminateInstances
  - ModifyInstanceAttribute
gcp:
  - SetIamPolicy
  - CreateServiceAccountKey
  - v1.compute.instances.stop
  - v1.compute.instances.delete
  - v1.compute.instances.setMachineType
tencent:
  - AttachUserPolicy
  - AttachUserPolicies
  - CreateApiKey
  - StopInstances
  - TerminateInstances