45 lines (36 loc) · 2.04 KB

Bucket Scanner architecture

Multi-cloud Object Storage security scanner: metadata APIs, optional anonymous probe, Terraform drift, CI gates.

Pipeline

CLI / Action loads flags, profiles, and .bucket-scanner.toml
Cloud backend collects bucket snapshots (YC, AWS, Azure, GCS)
Checks emit normalized Finding records
Gate applies suppressions and baseline delta
Chains compose compound risks
Report renders human (Rich), JSON (report_schema: 1.0), SARIF, Prometheus

Modules

Module	Role
`bucket_scanner.yc`	Yandex Cloud management + S3 API
`bucket_scanner.aws`	AWS S3 + IAM helpers
`bucket_scanner.azure`	Azure subscription inventory
`bucket_scanner.gcs`	GCS project inventory
`bucket_scanner.checks`	Detectors (ACL, policy, encryption, cloud-specific BPA)
`bucket_scanner.gate`	Suppressions, baseline fingerprints, delta
`bucket_scanner.chains`	Misconfig graph composer
`bucket_scanner.probe`	Anonymous HTTP reachability (no redirect follow)
`bucket_scanner.secrets`	Repo credential pattern scan
`bucket_scanner.terraform`	IaC intent parsing + drift
`bucket_scanner.report`	Human / JSON / SARIF / Prometheus
`bucket_scanner.serve`	`/metrics` + `/health` exporter

Cloud backends

Cloud	Live scan	Fixture	Terraform drift
Yandex Cloud	Yes	Yes	`yandex_storage_bucket`
AWS S3	Yes	Yes	`aws_s3_*` + BPA
Azure Blob	Yes (`[azure]`)	Yes	Planned
GCS	Yes (`[gcs]`)	Yes	Planned

Credential model

YC: YC_TOKEN or SA key file; optional static YC_ACCESS_KEY_*. Without static keys the scanner mints ephemeral AWS-compatible credentials and/or enriches via Storage Bucket.Get (VIEW_FULL).
AWS: env keys, session token, or AWS_PROFILE / OIDC on GitHub Actions
Azure: DefaultAzureCredential, AZURE_SUBSCRIPTION_ID or --folder-id
GCS: Application Default Credentials, GCP_PROJECT or --folder-id