Troubleshooting and FAQ

Troubleshooting and FAQ

gcpwn command not found

Run with module entrypoint:

python -m gcpwn

If installed via pip, confirm the Python environment and PATH.

Table output not working

Install optional table dependency:

pip install prettytable==3.17.0

Then:

configs set std_output_format table

Excel export fails

Install optional dependency:

pip install xlsxwriter==3.2.9

Then rerun:

data export excel

Why isn't there a Game Servers (or Cloud Life Sciences) module?

Google retired both the Game Servers (gameservices) and Cloud Life Sciences APIs. Game Servers was enumerable during early development but has been removed — the API returns 404 and the client library no longer imports on Python 3.12+ — so there is no enum_gameservers module. These are dead upstream APIs, nothing to enumerate.

Why doesn't enum_all run Cloud Asset Inventory?

enum_asset_inventory is opt-in. A bare modules run enum_all deliberately skips it because org-wide CAI scans are slow. It is additive: run modules run enum_all --asset-inventory to do everything PLUS the CAI scan, or run modules run enum_asset_inventory on its own. When it runs it upserts into the shared tables (IAM allow policies, hierarchy, service accounts/keys/roles, compute instances, WIF), so it doubles as a fallback when per-service enumeration is denied but cloudasset.* is granted.

Workspace enumeration returns no groups/users/devices

The Google Workspace modules need a service account with domain-wide delegation and an admin subject to impersonate. Set it once with configs set workspace_admin_subject admin@yourdomain.com, or pass --impersonate admin@yourdomain.com on the module. See Authentication Reference.

Build the OpenGraph from a CAI export file (no enumeration / no SQLite)

If you have a Cloud Asset Inventory export (NDJSON from gcloud asset export, or a JSON array of assets), you can build the BloodHound OpenGraph graph directly from that file — no prior enumeration and no SQLite required:

modules run process_og_gcpwn_data --cai-file ./cai_export.json -o ./bh_out

The graph is exported to the -o/--out directory but is not persisted to the workspace's opengraph tables.

process_og_gcpwn_data says IAM policy data is missing

Run IAM policy collection first:

modules run enum_gcp_policy_bindings --ensure-tree

OpenGraph warns that rules are skipped

Cause: required permissions in a rule are not in gcpwn/mappings/og_permission_to_roles_map.json.

Fix:

1. Add missing permissions to your permission-role mapping workflow input.
2. Rebuild/update og_permission_to_roles_map.json.
3. Re-run OpenGraph.

See OpenGraph - Add Your Own Content.

Why are my conditional IAM expressions not strictly evaluated?

Current conditionals engine is placeholder / pass-through:

• condition metadata is preserved and propagated. A conditioned binding gets a deterministic node-id suffix #cond:<10-hex-hash> plus conditional=true, condition_expr_raw, and condition_hash properties.
• the CEL expression itself is not evaluated. The same expression always hashes to the same node (dedup); distinct expressions become distinct nodes.
• --cond-eval runs the conditional workflow in pass-through mode only — it does not narrow resources yet, so output is identical whether it is on or off.

Use condition fields as context, not a guaranteed deny/allow evaluator.

How do I analyze findings?

There is no single "findings" module — practical analysis today runs through:

• process_gcp_iam_bindings (the materialized who-can-do-what report)
• OpenGraph output + BloodHound queries (attack-path modeling)