Skip to content

AuditKit v0.7.0 - Google Cloud Platform Support

Choose a tag to compare

View all tags
@mrmez mrmez released this 04 Nov 14:48
· 63 commits to main since this release
v0.7.0
6fb595b

Release Date: November 4, 2025

AuditKit now supports Google Cloud Platform (GCP) alongside AWS and Azure, making it the first open-source compliance scanner with unified coverage across all three major cloud providers.

What's New

Google Cloud Platform (GCP) Support

Scan GCP projects for SOC2, PCI-DSS, CMMC Level 1, NIST 800-53, ISO 27001, and CIS Benchmarks compliance.

Supported GCP Services:

  • Cloud Storage (GCS) - Public access, encryption, versioning, logging
  • Cloud IAM - Service account keys, MFA, primitive roles
  • Compute Engine - Public IPs, OS patching, disk encryption, Shielded VM
  • VPC Networks - Firewall rules, network segmentation, flow logs
  • Cloud SQL - Public exposure, SSL enforcement, backups, encryption
  • Cloud KMS - Key rotation policies, encryption at rest
  • Cloud Logging - Audit logs, retention, export, log sinks
  • GKE (Kubernetes Engine) - Binary authorization, network policies, dashboard access
  • BigQuery - Dataset encryption, access controls

170+ automated security checks across these services.

Quick Start:

# Authenticate with GCP
gcloud auth application-default login
export GOOGLE_CLOUD_PROJECT=my-project-id

# Run SOC2 scan
./auditkit scan -provider gcp -framework soc2

# Generate PDF report
./auditkit scan -provider gcp -framework soc2 -format pdf -output gcp-soc2-report.pdf

New Compliance Frameworks

NIST 800-53 Rev 5

  • ~150 automated technical controls across AWS, Azure, and GCP
  • Covers FedRAMP Low/Moderate/High baseline requirements
  • Essential for federal contractors and FedRAMP pursuits
  • Framework crosswalk from existing SOC2/PCI/CMMC controls
  • Use: -framework 800-53

ISO 27001:2022

  • 93 total controls in the framework (54+ automated via crosswalk)
  • Focus on Annex A technical controls (A.8)
  • International information security standard
  • Required for global enterprise sales and certifications
  • Use: -framework iso27001

CIS Benchmarks

  • AWS: 129 automated controls (combines CIS v1.4 and v3.0)
  • Azure: 40+ automated controls (CIS Microsoft Azure Foundations v3.0)
  • GCP: 56 automated controls (CIS Google Cloud Platform Foundations)
  • Security hardening best practices beyond compliance checkboxes
  • Proactive defense to reduce attack surface
  • Use: -framework cis-aws, -framework cis-azure, -framework cis-gcp

Framework Coverage

All cloud providers now support the same frameworks with consistent reporting:

Framework AWS Azure GCP Purpose
SOC2 Type II 64 controls 64 controls 40 controls SaaS trust & security
PCI-DSS v4.0 30 controls 30 controls 30 controls Payment card security
HIPAA 70 mappings 62 mappings 40 mappings Healthcare data protection
CMMC Level 1 17 practices 17 practices 17 practices DoD contractor compliance
NIST 800-53 Rev 5 150+ controls 150+ controls 150+ controls Federal/FedRAMP foundation
ISO 27001:2022 54+ controls 54+ controls 54+ controls International InfoSec
CIS Benchmarks 129 controls 40+ controls 56 controls Security hardening

Enhanced Framework Coverage

PCI-DSS Completion

  • All 12 requirements now fully documented across all clouds
  • Added Requirements 2, 5, 6, 9, 11, 12 organizational controls
  • Complete coverage with both automated and manual controls

HIPAA Production Ready

  • AWS: 70 framework mappings
  • Azure: 62 framework mappings
  • GCP: 40 framework mappings
  • Moved from experimental to production status for technical safeguards

CMMC Level 1 Verified

  • All 17 official practices confirmed
  • Complete coverage across AWS, Azure, and GCP
  • Removed mislabeled Level 2 controls

CSV Export

Export compliance results to spreadsheet format for compliance teams:

./auditkit scan -provider gcp -framework soc2 -format csv -output results.csv
  • Compatible with Excel and Google Sheets
  • Includes: Control ID, Name, Status, Severity, Evidence, Remediation, Console URLs
  • Proper CSV escaping for special characters

Provider-Specific Binaries

Choose the right binary for your environment:

Universal Binary (All Platforms)

  • Supports AWS + Azure + GCP in one binary
  • Available for: Linux (amd64, arm64), Windows (amd64), macOS (Intel, Apple Silicon)
  • Size: ~280MB
  • Best for: Multi-cloud environments, desktop usage, Windows/Mac users

Provider-Specific Binaries (Linux Only)

  • auditkit-aws - AWS-only (20MB, 93% smaller)
  • auditkit-azure - Azure-only (26MB, 91% smaller)
  • auditkit-gcp - GCP-only (44MB, 84% smaller)
  • Best for: CI/CD pipelines, Docker containers, single-cloud deployments

Important: Provider-specific binaries are available for Linux only. Windows and macOS users should use the universal binary.

Documentation Restructure

The README was getting unwieldy at 1000+ lines, so we reorganized:

Before: Everything crammed into README.md

After:

  • docs/frameworks/ - One guide per framework (CIS, ISO 27001, NIST 800-53)
  • docs/setup/ - Provider-specific authentication and setup
  • docs/examples/ - CI/CD integration examples
  • README.md - Clean overview with links to detailed docs

Installation

Universal Binary (Recommended for Windows/Mac)

Linux (amd64):

wget https://github.com/guardian-nexus/auditkit/releases/download/v0.7.0/auditkit-v0.7.0-linux-amd64.tar.gz
tar -xzf auditkit-v0.7.0-linux-amd64.tar.gz
chmod +x auditkit-linux-amd64
./auditkit-linux-amd64 scan -provider gcp -framework soc2

Linux (arm64):

wget https://github.com/guardian-nexus/auditkit/releases/download/v0.7.0/auditkit-v0.7.0-linux-arm64.tar.gz
tar -xzf auditkit-v0.7.0-linux-arm64.tar.gz
chmod +x auditkit-linux-arm64
./auditkit-linux-arm64 scan -provider aws -framework pci

Windows (amd64):

# Download auditkit-v0.7.0-windows-amd64.zip from releases
# Extract and run:
.\auditkit-windows-amd64.exe scan -provider azure -framework soc2

macOS (Intel):

wget https://github.com/guardian-nexus/auditkit/releases/download/v0.7.0/auditkit-v0.7.0-darwin-amd64.tar.gz
tar -xzf auditkit-v0.7.0-darwin-amd64.tar.gz
chmod +x auditkit-darwin-amd64
./auditkit-darwin-amd64 scan -provider aws -framework 800-53

macOS (Apple Silicon):

wget https://github.com/guardian-nexus/auditkit/releases/download/v0.7.0/auditkit-v0.7.0-darwin-arm64.tar.gz
tar -xzf auditkit-v0.7.0-darwin-arm64.tar.gz
chmod +x auditkit-darwin-arm64
./auditkit-darwin-arm64 scan -provider gcp -framework iso27001

Provider-Specific Binaries (Linux Only - CI/CD Optimized)

AWS Only (20MB):

wget https://github.com/guardian-nexus/auditkit/releases/download/v0.7.0/auditkit-aws-v0.7.0-linux-amd64.tar.gz
tar -xzf auditkit-aws-v0.7.0-linux-amd64.tar.gz
chmod +x auditkit-aws-linux-amd64
./auditkit-aws-linux-amd64 scan -framework cis-aws

Azure Only (26MB):

wget https://github.com/guardian-nexus/auditkit/releases/download/v0.7.0/auditkit-azure-v0.7.0-linux-amd64.tar.gz
tar -xzf auditkit-azure-v0.7.0-linux-amd64.tar.gz
chmod +x auditkit-azure-linux-amd64
./auditkit-azure-linux-amd64 scan -framework cis-azure

GCP Only (44MB):

wget https://github.com/guardian-nexus/auditkit/releases/download/v0.7.0/auditkit-gcp-v0.7.0-linux-amd64.tar.gz
tar -xzf auditkit-gcp-v0.7.0-linux-amd64.tar.gz
chmod +x auditkit-gcp-linux-amd64
./auditkit-gcp-linux-amd64 scan -framework soc2

GCP Authentication

Three authentication methods supported:

Option 1: Application Default Credentials (Recommended)

gcloud auth application-default login
export GOOGLE_CLOUD_PROJECT=my-project-id
./auditkit scan -provider gcp -framework soc2

Option 2: Service Account Key

export GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json
export GOOGLE_CLOUD_PROJECT=my-project-id
./auditkit scan -provider gcp -framework pci

Option 3: GCE Metadata (for Compute Engine)

# Automatically detected when running on GCE, just set project ID
export GOOGLE_CLOUD_PROJECT=my-project-id
./auditkit scan -provider gcp -framework cmmc

Required Permissions: roles/viewer or equivalent read-only access to your GCP project.

Usage Examples

Multi-cloud SOC2 assessment:

./auditkit-linux-amd64 scan -provider aws -framework soc2 -format pdf -output aws-soc2.pdf
./auditkit-linux-amd64 scan -provider azure -framework soc2 -format pdf -output azure-soc2.pdf
./auditkit-linux-amd64 scan -provider gcp -framework soc2 -format pdf -output gcp-soc2.pdf

GCP security hardening with CIS Benchmarks:

./auditkit-gcp-linux-amd64 scan -framework cis-gcp -format html -output gcp-hardening.html

NIST 800-53 assessment for FedRAMP:

./auditkit-linux-amd64 scan -provider aws -framework 800-53 -format csv -output nist-results.csv

ISO 27001 technical controls:

./auditkit-linux-amd64 scan -provider gcp -framework iso27001 -format pdf -output iso-report.pdf

PCI-DSS for payment processing:

./auditkit-linux-amd64 scan -provider azure -framework pci -format html -output pci-report.html

Example Output

AuditKit v0.7.0 - SOC2 Compliance Scan
======================================
Provider: GCP
Project: production-project-12345
Framework: SOC2 Type II Trust Services Criteria
Scan Date: 2025-11-04 10:30:00 UTC

Overall Compliance Score: 72.5% (29/40 controls passed)

CRITICAL - Fix These NOW:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[FAIL] CC6.6 - User MFA Enforcement
       Evidence: 12 users without MFA enabled
       Remediation: gcloud iam policies set-iam-policy ...

[FAIL] CC6.2 - Public Storage Access
       Evidence: 3 GCS buckets allow public access
       Buckets: backup-prod, logs-archive, static-assets

[FAIL] CC6.1 - Service Account Key Rotation
       Evidence: 5 service account keys older than 90 days
       Keys: sa-prod@project.iam (183 days), sa-backup@project.iam (274 days)

HIGH - Address Soon:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[FAIL] CC7.1 - Audit Logging
[FAIL] CC6.3 - Disk Encryption

Report saved to: gcp-soc2-report-2025-11-04.pdf

Breaking Changes

None. This is a purely additive release. All existing functionality for AWS and Azure remains unchanged.

Bug Fixes

  • Fixed framework filtering for NIST 800-53 crosswalk mappings
  • Improved error messages for missing cloud provider credentials
  • Fixed nil pointer dereferences when API calls fail
  • Corrected CMMC Level 1 control count (removed mislabeled Level 2 controls)

Known Limitations

Automated Checks Only

This tool scans technical infrastructure configurations. Full compliance certification requires:

  • Documented policies and procedures
  • Employee training and awareness programs
  • Physical security controls
  • Third-party risk assessments
  • Business continuity planning
  • Formal audits by qualified assessors (C3PAO for CMMC, QSA for PCI-DSS, etc.)

Not a Certification

High scan scores do not equal compliance certification. AuditKit helps you:

  • Identify technical control gaps
  • Prepare for formal assessments
  • Track compliance progress over time
  • Generate evidence for auditors

Use AuditKit as part of a comprehensive compliance program, not as a replacement for professional audits.

What's Not Included (Free Version)

The following features are available in AuditKit Pro:

  • Multi-account/multi-project scanning (AWS Organizations, Azure Management Groups, GCP Folders)
  • Enhanced SOC2 with 78 additional controls
  • Advanced GKE and Vertex AI compliance checks
  • Evidence package generation for audit-ready documentation
  • Exception and waiver management
  • Continuous monitoring daemon for ongoing compliance
  • Multi-environment drift detection (dev vs prod consistency)

Interested in Pro features? Contact: info@auditkit.io

What's Next

Roadmap for upcoming releases:

v0.8.0 (Planned: December 2025)

  • FedRAMP baseline filtering (Low/Moderate/High)
  • Additional CIS coverage for Azure and GCP
  • Enhanced multi-account orchestration
  • Performance optimizations for large-scale scans

v0.9.0 (Planned: Q1 2026)

  • Kubernetes compliance scanning (CIS Kubernetes Benchmarks)
  • Container security scanning
  • IaC compliance (Terraform, CloudFormation)

Getting Help

Full Changelog

See CHANGELOG.md for complete details of all changes in this release.

AuditKit v0.7.0 - Multi-cloud compliance scanning for AWS, Azure, and GCP.

Assets 19
Loading