google-cloud-filestore-auditing

Files (6)

• SKILL.md
• audit-rules-matrix.md · references/
• backup-dr-governance.md · references/
• security-access-governance.md · references/
• zone-isolation-pzi-pzs.md · references/
• filestore_audit.py · scripts/

SKILL.md (first lines)

# Filestore Auditing Skill

This skill enables autonomous agents to audit, evaluate, and report the disaster
recovery, security access governance, and architectural reliability posture of
Filestore fleets across Google Cloud projects.

## Prerequisites / IAM Requirements & Permissions

Before executing this skill, the runtime principal (user account or Service
Account) must possess the following IAM roles and granular permissions on the
target GCP project(s):

### 1. Audit Operations (Read-Only Assessment)

Requires the **`roles/file.viewer`** role, which provides:

-   **`file.instances.list`**: Enumerate Filestore instances across project
    locations.
-   **`file.instances.get`**: Inspect instance configuration, NFS export rules,
    IP ranges, squash mode, and PZI/PZS isolation status.
-   **`file.backups.list`**: Enumerate existing backups across regions.
-   **`file.backups.get`**: Inspect backup timestamps, source instance URIs, and
    status.

### 2. Remediation Operations (Backup Creation)

Requires the **`roles/file.editor`** (or `roles/file.admin`) role, which
provides:

-   **`file.backups.create`**: Create on-demand baseline backups for unprotected
    instances.
-   **`file.operations.get`**: Monitor long-running backup creation operations.

### 3. MCP Tool Invocation

If invoking capabilities via the Filestore MCP Server
(`file.googleapis.com/mcp`):

-   **`roles/mcp.toolUser`**: Required to execute MCP tools (`list_instances`,
    `get_instance`, `list_backups`, `get_backup`, `create_backup`).

### 4. Cloud Authentication Setup

Authenticate the runtime environment using the appropriate method for your execution context:

-   **CLI Execution (`gcloud`)**:
    ```bash
    gcloud auth login
    ```
-   **Application SDKs & Scripts**:
    ```bash
    gcloud auth application-default login
    ```
-   **Automated Services & Service Accounts**:
    ```bash
    export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account-key.json"
    ```

### 5. Billing Account Attachment

-   **Active Billing Required**: The target GCP project must have an active Cloud Billing account attached. Filestore instances and backup operations require active billing. Verify billing status with:
    ```bash
    gcloud beta billing projects describe {project_id}
    ```

## Quick Start

1.  Ensure `gcloud` is installed. See
    [gcloud installation guide](https://docs.cloud.google.com/sdk/docs/install-sdk.md.txt) if
    needed.
2.  Authenticate your environment:

    ```bash
    gcloud auth login
    gcloud auth application-default login
    ```
3.  Set the target project context and verify an active billing account is attached:

    ```bash
    gcloud config set project {project_id}
    gcloud beta billing projects describe {project_id}
    ```
4.  Configure a well-supported default region (e.g., `us-central1`). See official
    [region availability documentation](https://cloud.google.com/about/locations):

    ```bash
    gcloud config set compute/region us-central1
    ```
5.  Verify required service APIs are enabled:

    ```bash
    gcloud services enable file.googleapis.com --quiet
    ```
6.  Run fleet discovery and backup inventory (see "Discovery & Read Operations"
    below).
7.  Evaluate findings against the audit rules matrix and render the executive
    scorecard and inventory table.
8.  If unprotected instances are identified, present baseline backup creation
    commands and prompt the user for confirmation.

## Attribution Guardrail

Tag every Cloud Filestore command or API request provided or executed. Prefix
`gcloud` commands with the designated metrics environment:

```bash
CLOUDSDK_METRICS_ENVIRONMENT="gcs-skills gcs-skills/1.0 (skill:google-cloud-filestore-auditing)" \
gcloud filestore instances list ...
```

On direct HTTP calls to the GCP REST API, append the `User-Agent`:

```
User-Agent: gcs-skills/1.0 (skill:google-cloud-filestore-auditing)
```

## Conceptual & Informational Queries (CRITICAL)

For purely conceptual, educational, or architectural questions (e.g., *"What is

From google/skills, Apache-2.0.

More from google/skills