Skip to content
Hann .
All projects

PF-05 · Multi-cloud · Python

Multi-cloud asset and audit automation

A Python tool that collects assets, permissions, and audit logs from AWS, GCP, and Tencent Cloud into one schema, and alerts on risky events.

Role
Design and implementation
Period
Personal project · released Nov 2026
Cloud
AWS · GCP · Tencent
Scale
3 clouds · 7 collectors · 49 audit actions
Key tech
Python · boto3 · Google Cloud SDK · Tencent Cloud SDK · Google Sheets · Slack · Telegram
GitHub
3
Clouds covered by the public code
7
Collectors by resource type
49
Audit actions tracked (16 alert immediately)

At a glance

AWSGCPTencentCross-account roleiamfirewallinstanceloadbalancervpcaudit_logunusedCommon schemaGoogle SheetsSlackTelegramImmediate alerts on critical eventsMonthly archive
Audit sheets are copied to CSV once a month into year and month folders.

Problem

Each cloud returns the same concept in a different shape. Comparing permissions or firewalls meant reading three formats by hand.

Approach

Each account is reached through a cross-account role such as STS AssumeRole. Seven collectors, one per resource type, feed a single data class per resource. Output goes to Google Sheets and CSV, and 16 critical events alert Slack and Telegram immediately based on critical_events.yaml.

Result

The production tool behind this code checked four clouds including Azure every day before dawn, removed several days of manual month-end review, and together with Terraform defaults and CI gates helped raise the remediation rate from 60% to over 85%. Those figures are production results and were not measured in this repository.

Up close

Critical event rulesAWSGCPTencentAttachUserPolicyCreateAccessKeyStopInstancesTerminateInstancesModifyInstanceAttributeSetIamPolicyCreateServiceAccountKeyinstances.stopinstances.deleteinstances.setMachineTypeAttachUserPolicyAttachUserPoliciesCreateApiKeyStopInstancesTerminateInstancesResetInstancesTypeChange the rules in critical_events.yamlSlackTelegram
Only events on the list go to Slack and Telegram right away.
Finding unused resourcesElastic IPSecurity GroupEBS volumeNot attached to anythingAttached to no network interfaceAttached to no instanceFOUNDFOUNDFOUNDGCP and Tencent are checked for idle resources the same way
GCP and Tencent are checked the same way for idle IPs, disks, and firewalls.

One schema per resource

What this code does: Normalizes IAM data from all three clouds into the same fields.

@dataclass(frozen=True)
class IamRecord(Record):
    sheet: ClassVar[str] = "IAM"
    cloud: str
    project: str
    project_id: str
    user_name: str
    user_id: str
    user_group: str = ""
    permission: str = ""
    user_creation_time: str = ""
    access_key: str = ""
    access_key_creation_time: str = ""
    last_login: str = ""
    password_last_changed: str = ""

Critical events as data

What this code does: Keeps the events that alert immediately in a list outside the code.

aws:
  - AttachUserPolicy
  - CreateAccessKey
  - StopInstances
  - TerminateInstances
  - ModifyInstanceAttribute
gcp:
  - SetIamPolicy
  - CreateServiceAccountKey
  - v1.compute.instances.stop
  - v1.compute.instances.delete
  - v1.compute.instances.setMachineType
tencent:
  - AttachUserPolicy
  - AttachUserPolicies
  - CreateApiKey
  - StopInstances
  - TerminateInstances

What I learned

Keeping the critical event list as data lets a security reviewer read and change the rules without reading Python.

What I would improve

GCP and Tencent paths are tested with mocks, not live accounts. Tencent multi-account access needs one CAM role per account.

Related field notes

Open to work · Cloud infrastructure and security