Update codeowners

Cloudfox GCP Functionality

.github/CODEOWNERS

@@ -1 +1 @@
-@sethsec-bf carlosvendramini-bf
+* @bishopfaure @dbravo-bishopfox 

.gitignore

@@ -15,6 +15,7 @@
 # Dependency directories (remove the comment below to include it)
 # vendor/
 .vscode
+.idea
 launch.json
 
 ######################################################

aws/api-gws.go

@@ -2,7 +2,6 @@ package aws
 
 import (
 	"fmt"
-	"os"
 	"path/filepath"
 	"sort"
 	"strconv"
@@ -144,7 +143,7 @@ func (m *ApiGwModule) PrintApiGws(outputDirectory string, verbosity int) {
 			Name:   m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
-		loot := m.writeLoot(o.Table.DirectoryName, verbosity)
+		loot := m.writeLoot(filepath, verbosity)
 		o.Loot.LootFiles = append(o.Loot.LootFiles, internal.LootFile{
 			Name:     m.output.CallingModule,
 			Contents: loot,
@@ -207,12 +206,6 @@ func (m *ApiGwModule) executeChecks(r string, wg *sync.WaitGroup, semaphore chan
 
 func (m *ApiGwModule) writeLoot(outputDirectory string, verbosity int) string {
 	path := filepath.Join(outputDirectory, "loot")
-	err := os.MkdirAll(path, os.ModePerm)
-	if err != nil {
-		m.modLog.Error(err.Error())
-		m.CommandCounter.Error++
-		panic(err.Error())
-	}
 	f := filepath.Join(path, "api-gws.txt")
 
 	var out string

aws/api-gws_test.go

@@ -9,6 +9,7 @@ import (
 	"github.com/BishopFox/cloudfox/internal"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/aws/smithy-go/ptr"
 	"github.com/spf13/afero"
 )
 
@@ -29,7 +30,8 @@ func TestApiGw(t *testing.T) {
 
 	fs := internal.MockFileSystem(true)
 	defer internal.MockFileSystem(false)
-	tmpDir := "~/.cloudfox/"
+	//tmpDir := "~/.cloudfox/"
+	tmpDir := ptr.ToString(internal.GetLogDirPath())
 
 	m.PrintApiGws(tmpDir, 2)
 

aws/databases.go

@@ -3,7 +3,6 @@ package aws
 import (
 	"errors"
 	"fmt"
-	"os"
 	"path/filepath"
 	"sort"
 	"strconv"
@@ -22,7 +21,6 @@ type DatabasesModule struct {
 	RDSClient      sdk.RDSClientInterface
 	RedshiftClient sdk.AWSRedShiftClientInterface
 	DynamoDBClient sdk.DynamoDBClientInterface
-	DocDBClient    sdk.DocDBClientInterface
 
 	Caller        sts.GetCallerIdentityOutput
 	AWSRegions    []string
@@ -53,6 +51,7 @@ type Database struct {
 	Protocol   string
 	Public     string
 	Size       string
+	Roles      string
 }
 
 func (m *DatabasesModule) PrintDatabases(outputDirectory string, verbosity int) {
@@ -68,13 +67,13 @@ func (m *DatabasesModule) PrintDatabases(outputDirectory string, verbosity int)
 	}
 
 	fmt.Printf("[%s][%s] Enumerating databases for account %s.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), aws.ToString(m.Caller.Account))
-	fmt.Printf("[%s][%s] Supported Services: RDS, DynamoDB\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
+	fmt.Printf("[%s][%s] Supported Services: RDS, Redshift, DynamoDB, DocumentDB, Neptune\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
 
 	wg := new(sync.WaitGroup)
 	semaphore := make(chan struct{}, m.Goroutines)
 	// Create a channel to signal the spinner aka task status goroutine to finish
 	spinnerDone := make(chan bool)
-	//fire up the the task status spinner/updated
+	//fire up the task status spinner/updated
 	go internal.SpinUntil(m.output.CallingModule, &m.CommandCounter, spinnerDone, "tasks")
 
 	//create a channel to receive the objects
@@ -112,7 +111,8 @@ func (m *DatabasesModule) PrintDatabases(outputDirectory string, verbosity int)
 		"Size",
 		"UserName",
 		"Endpoint",
-		//"Port",
+		"Port",
+		"Roles",
 		//"Protocol",
 		//"Public",
 
@@ -139,6 +139,8 @@ func (m *DatabasesModule) PrintDatabases(outputDirectory string, verbosity int)
 			"Size",
 			"UserName",
 			"Endpoint",
+			"Port",
+			"Roles",
 		}
 		// Otherwise, use the default columns.
 	} else {
@@ -150,6 +152,7 @@ func (m *DatabasesModule) PrintDatabases(outputDirectory string, verbosity int)
 			"Size",
 			"UserName",
 			"Endpoint",
+			"Port",
 		}
 	}
 
@@ -166,7 +169,8 @@ func (m *DatabasesModule) PrintDatabases(outputDirectory string, verbosity int)
 				m.Databases[i].Size,
 				m.Databases[i].UserName,
 				m.Databases[i].Endpoint,
-				// strconv.Itoa(int(m.Databases[i].Port)),
+				strconv.Itoa(int(m.Databases[i].Port)),
+				m.Databases[i].Roles,
 				// m.Databases[i].Protocol,
 				// m.Databases[i].Public,
 			},
@@ -174,13 +178,17 @@ func (m *DatabasesModule) PrintDatabases(outputDirectory string, verbosity int)
 
 	}
 	if len(m.output.Body) > 0 {
-		m.output.FilePath = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		filepath := filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
 
 		o := internal.OutputClient{
 			Verbosity:     verbosity,
 			CallingModule: m.output.CallingModule,
 			Table: internal.TableClient{
-				Wrap: m.WrapTable,
+				Wrap:          m.WrapTable,
+				DirectoryName: filepath,
+			},
+			Loot: internal.LootClient{
+				DirectoryName: filepath,
 			},
 		}
 		o.Table.TableFiles = append(o.Table.TableFiles, internal.TableFile{
@@ -190,9 +198,15 @@ func (m *DatabasesModule) PrintDatabases(outputDirectory string, verbosity int)
 			Name:      m.output.CallingModule,
 		})
 		o.PrefixIdentifier = m.AWSProfile
-		o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
-		o.WriteFullOutput(o.Table.TableFiles, nil)
-		m.writeLoot(o.Table.DirectoryName, verbosity)
+		loot := m.writeLoot(filepath, verbosity)
+		//o.Table.DirectoryName = filepath.Join(outputDirectory, "cloudfox-output", "aws", fmt.Sprintf("%s-%s", m.AWSProfile, aws.ToString(m.Caller.Account)))
+		//m.writeLoot(o.Table.DirectoryName, verbosity)
+		o.Loot.LootFiles = append(o.Loot.LootFiles, internal.LootFile{
+			Name:     "databases-UrlsOnly.txt",
+			Contents: loot,
+		})
+		o.WriteFullOutput(o.Table.TableFiles, o.Loot.LootFiles)
+
 		fmt.Printf("[%s][%s] %s databases found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(m.output.Body)))
 	} else {
 		fmt.Printf("[%s][%s] No databases found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
@@ -217,56 +231,74 @@ func (m *DatabasesModule) Receiver(receiver chan Database, receiverDone chan boo
 func (m *DatabasesModule) executeChecks(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database) {
 	defer wg.Done()
 
-	servicemap := &awsservicemap.AwsServiceMap{
+	serviceMap := &awsservicemap.AwsServiceMap{
 		JsonFileSource: "DOWNLOAD_FROM_AWS",
 	}
-	res, err := servicemap.IsServiceInRegion("rds", r)
-	if err != nil {
-		m.modLog.Error(err)
-	}
-	if res {
-		m.CommandCounter.Total++
-		wg.Add(1)
-		go m.getRdsClustersPerRegion(r, wg, semaphore, dataReceiver)
-	}
-	res, err = servicemap.IsServiceInRegion("redshift", r)
-	if err != nil {
-		m.modLog.Error(err)
-	}
-	if res {
-		m.CommandCounter.Total++
-		wg.Add(1)
-		m.getRedshiftDatabasesPerRegion(r, wg, semaphore, dataReceiver)
-	}
-	res, err = servicemap.IsServiceInRegion("dynamodb", r)
-	if err != nil {
-		m.modLog.Error(err)
-	}
-	if res {
-		m.CommandCounter.Total++
-		wg.Add(1)
-		m.getDynamoDBTablesPerRegion(r, wg, semaphore, dataReceiver)
-	}
-	res, err = servicemap.IsServiceInRegion("docdb", r)
-	if err != nil {
-		m.modLog.Error(err)
-	}
-	if res {
-		m.CommandCounter.Total++
-		wg.Add(1)
-		m.getDocDBTablesPerRegion(r, wg, semaphore, dataReceiver)
-	}
-
+	m.executeRdsCheck(r, wg, semaphore, dataReceiver, serviceMap) // Also returns Neptune and DocDB
+	m.executeRedshiftCheck(r, wg, semaphore, dataReceiver, serviceMap)
+	m.executeDynamoDbCheck(r, wg, semaphore, dataReceiver, serviceMap)
 }
 
-func (m *DatabasesModule) writeLoot(outputDirectory string, verbosity int) {
-	path := filepath.Join(outputDirectory, "loot")
-	err := os.MkdirAll(path, os.ModePerm)
+type check struct {
+	region       string
+	wg           *sync.WaitGroup
+	semaphore    chan struct{}
+	dataReceiver chan Database
+	serviceMap   *awsservicemap.AwsServiceMap
+	service      string
+	executor     func(string, *sync.WaitGroup, chan struct{}, chan Database)
+}
+
+func (m *DatabasesModule) executeCheck(check check) {
+	res, err := check.serviceMap.IsServiceInRegion(check.service, check.region)
 	if err != nil {
-		m.modLog.Error(err.Error())
-		m.CommandCounter.Error++
-		panic(err.Error())
+		m.modLog.Error(err)
 	}
+	if res {
+		m.CommandCounter.Total++
+		check.wg.Add(1)
+		go check.executor(check.region, check.wg, check.semaphore, check.dataReceiver)
+	}
+}
+
+func (m *DatabasesModule) executeRdsCheck(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database, servicemap *awsservicemap.AwsServiceMap) {
+	m.executeCheck(check{
+		region:       r,
+		wg:           wg,
+		semaphore:    semaphore,
+		dataReceiver: dataReceiver,
+		serviceMap:   servicemap,
+		service:      "rds",
+		executor:     m.getRdsClustersPerRegion,
+	})
+}
+
+func (m *DatabasesModule) executeRedshiftCheck(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database, servicemap *awsservicemap.AwsServiceMap) {
+	m.executeCheck(check{
+		region:       r,
+		wg:           wg,
+		semaphore:    semaphore,
+		dataReceiver: dataReceiver,
+		serviceMap:   servicemap,
+		service:      "redshift",
+		executor:     m.getRedshiftDatabasesPerRegion,
+	})
+}
+
+func (m *DatabasesModule) executeDynamoDbCheck(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database, servicemap *awsservicemap.AwsServiceMap) {
+	m.executeCheck(check{
+		region:       r,
+		wg:           wg,
+		semaphore:    semaphore,
+		dataReceiver: dataReceiver,
+		serviceMap:   servicemap,
+		service:      "dynamodb",
+		executor:     m.getDynamoDBTablesPerRegion,
+	})
+}
+
+func (m *DatabasesModule) writeLoot(outputDirectory string, verbosity int) string {
+	path := filepath.Join(outputDirectory, "loot")
 	f := filepath.Join(path, "databases-UrlsOnly.txt")
 
 	var out string
@@ -275,12 +307,12 @@ func (m *DatabasesModule) writeLoot(outputDirectory string, verbosity int) {
 		out = out + fmt.Sprintln(database.Endpoint)
 	}
 
-	err = os.WriteFile(f, []byte(out), 0644)
-	if err != nil {
-		m.modLog.Error(err.Error())
-		m.CommandCounter.Error++
-		panic(err.Error())
-	}
+	// err = os.WriteFile(f, []byte(out), 0644)
+	// if err != nil {
+	// 	m.modLog.Error(err.Error())
+	// 	m.CommandCounter.Error++
+	// 	panic(err.Error())
+	// }
 
 	if verbosity > 2 {
 		fmt.Println()
@@ -291,6 +323,8 @@ func (m *DatabasesModule) writeLoot(outputDirectory string, verbosity int) {
 
 	fmt.Printf("[%s][%s] Loot written to [%s]\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), f)
 
+	return out
+
 }
 
 func (m *DatabasesModule) getRdsClustersPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database) {
@@ -307,45 +341,58 @@ func (m *DatabasesModule) getRdsClustersPerRegion(r string, wg *sync.WaitGroup,
 	m.CommandCounter.Pending--
 	m.CommandCounter.Executing++
 
-	DBInstances, err := sdk.CachedRDSDescribeDBInstances(m.RDSClient, aws.ToString(m.Caller.Account), r)
+	DBClusters, err := sdk.CachedRDSDescribeDBClusters(m.RDSClient, aws.ToString(m.Caller.Account), r)
 	if err != nil {
-		if errors.As(err, &oe) {
-			m.Errors = append(m.Errors, (fmt.Sprintf(" Error: Region: %s, Service: %s, Operation: %s", r, oe.Service(), oe.Operation())))
-		}
 		m.modLog.Error(err.Error())
 		m.CommandCounter.Error++
 		return
 	}
 
-	var public string
-	for _, instance := range DBInstances {
-		if instance.Endpoint != nil {
-			name := aws.ToString(instance.DBInstanceIdentifier)
-			port := instance.Endpoint.Port
-			endpoint := aws.ToString(instance.Endpoint.Address)
-			engine := aws.ToString(instance.Engine)
-
-			if aws.ToBool(instance.PubliclyAccessible) {
-				public = "True"
-			} else {
-				public = "False"
-			}
-
-			dataReceiver <- Database{
-				AWSService: "RDS",
-				Region:     r,
-				Name:       name,
-				Engine:     engine,
-				Endpoint:   endpoint,
-				UserName:   aws.ToString(instance.MasterUsername),
-				Port:       aws.ToInt32(port),
-				Protocol:   aws.ToString(instance.Engine),
-				Public:     public,
-			}
+	for _, cluster := range DBClusters {
+		var public string
+		var service string
+		var roles string
+		if cluster.Endpoint == nil {
+			continue
 		}
 
-	}
+		name := aws.ToString(cluster.DBClusterIdentifier)
+		port := cluster.Port
+		endpoint := aws.ToString(cluster.Endpoint)
+		engine := aws.ToString(cluster.Engine)
 
+		if aws.ToBool(cluster.PubliclyAccessible) {
+			public = "True"
+		} else {
+			public = "False"
+		}
+
+		if isNeptune(cluster.Engine) {
+			service = "Neptune"
+		} else if isDocDB(cluster.Engine) {
+			service = "DocsDB"
+		} else {
+			service = "RDS"
+		}
+
+		associatedRoles := cluster.AssociatedRoles
+		for _, role := range associatedRoles {
+			roles = roles + aws.ToString(role.RoleArn) + " "
+		}
+
+		dataReceiver <- Database{
+			AWSService: service,
+			Region:     r,
+			Name:       name,
+			Engine:     engine,
+			Endpoint:   endpoint,
+			UserName:   aws.ToString(cluster.MasterUsername),
+			Port:       aws.ToInt32(port),
+			Protocol:   aws.ToString(cluster.Engine),
+			Public:     public,
+			Roles:      roles,
+		}
+	}
 }
 
 func (m *DatabasesModule) getRedshiftDatabasesPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database) {
@@ -369,7 +416,7 @@ func (m *DatabasesModule) getRedshiftDatabasesPerRegion(r string, wg *sync.WaitG
 
 	if err != nil {
 		if errors.As(err, &oe) {
-			m.Errors = append(m.Errors, (fmt.Sprintf(" Error: Region: %s, Service: %s, Operation: %s", r, oe.Service(), oe.Operation())))
+			m.Errors = append(m.Errors, fmt.Sprintf(" Error: Region: %s, Service: %s, Operation: %s", r, oe.Service(), oe.Operation()))
 		}
 		m.modLog.Error(err.Error())
 		m.CommandCounter.Error++
@@ -381,19 +428,19 @@ func (m *DatabasesModule) getRedshiftDatabasesPerRegion(r string, wg *sync.WaitG
 		name := aws.ToString(cluster.DBName)
 		//id := workspace.Id
 		endpoint := aws.ToString(cluster.Endpoint.Address)
+		port := aws.ToInt32(cluster.Endpoint.Port)
 
 		if aws.ToBool(cluster.PubliclyAccessible) {
 			public = "True"
 		} else {
 			public = "False"
 		}
-		port := cluster.Endpoint.Port
 		dataReceiver <- Database{
 			AWSService: awsService,
 			Region:     r,
 			Name:       name,
 			Endpoint:   endpoint,
-			Port:       aws.ToInt32(port),
+			Port:       port,
 			Protocol:   protocol,
 			Public:     public,
 		}
@@ -442,48 +489,12 @@ func (m *DatabasesModule) getDynamoDBTablesPerRegion(r string, wg *sync.WaitGrou
 			Endpoint:   "N/A",
 		}
 	}
-
 }
 
-func (m *DatabasesModule) getDocDBTablesPerRegion(r string, wg *sync.WaitGroup, semaphore chan struct{}, dataReceiver chan Database) {
-	defer func() {
-		m.CommandCounter.Executing--
-		m.CommandCounter.Complete++
-		wg.Done()
+func isNeptune(engine *string) bool {
+	return *engine == "neptune"
+}
 
-	}()
-	semaphore <- struct{}{}
-	defer func() {
-		<-semaphore
-	}()
-	// m.CommandCounter.Total++
-	m.CommandCounter.Pending--
-	m.CommandCounter.Executing++
-	awsService := "DocDB"
-
-	Clusters, err := sdk.CachedDocDBDescribeDBClusters(m.DocDBClient, aws.ToString(m.Caller.Account), r)
-	if err != nil {
-		m.modLog.Error(err.Error())
-		m.CommandCounter.Error++
-		return
-	}
-
-	for _, cluster := range Clusters {
-		name := aws.ToString(cluster.DBClusterIdentifier)
-
-		endpoint := aws.ToString(cluster.Endpoint)
-		port := aws.ToInt32(cluster.Port)
-		//size := aws.ToInt64(TableOutput.Table.TableSizeBytes)
-		userName := aws.ToString(cluster.MasterUsername)
-
-		dataReceiver <- Database{
-			AWSService: awsService,
-			Region:     r,
-			Name:       name,
-			Endpoint:   endpoint,
-			Port:       port,
-			UserName:   userName,
-			//Size:       strconv.Itoa(int(size)),
-		}
-	}
+func isDocDB(engine *string) bool {
+	return *engine == "docdb"
 }

aws/databases_test.go

@@ -0,0 +1,57 @@
+package aws
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/BishopFox/cloudfox/aws/sdk"
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/sts"
+	"github.com/aws/smithy-go/ptr"
+	"github.com/spf13/afero"
+)
+
+func TestDatabasesCommand(t *testing.T) {
+
+	m := DatabasesModule{
+		AWSProfile: "unittesting",
+		AWSRegions: []string{"us-east-1"},
+		Caller: sts.GetCallerIdentityOutput{
+			Arn:     aws.String("arn:aws:iam::123456789012:user/Alice"),
+			Account: aws.String("123456789012"),
+		},
+		Goroutines:     3,
+		WrapTable:      false,
+		RDSClient:      &sdk.MockedRDSClient{},
+		DynamoDBClient: &sdk.MockedAWSDynamoDBClient{},
+		RedshiftClient: &sdk.MockedRedshiftClient{},
+	}
+
+	fs := internal.MockFileSystem(true)
+	defer internal.MockFileSystem(false)
+	tmpDir := ptr.ToString(internal.GetLogDirPath())
+
+	m.PrintDatabases(tmpDir, 2)
+	//resultsFile, err := afero.ReadFile(fs, "table/databases.txt")
+	resultsFilePath := filepath.Join(tmpDir, "cloudfox-output/aws/unittesting-123456789012/table/databases.txt")
+	resultsFile, err := afero.ReadFile(fs, resultsFilePath)
+	if err != nil {
+		t.Fatalf("Cannot read output file at %s: %s", resultsFile, err)
+	}
+
+	expectedResults := []string{
+		"db1.cluster-123456789012.us-west-2.rds.amazonaws.com",
+		"db2.cluster-123456789012.us-west-2.rds.amazonaws.com",
+		"db3.cluster-123456789012.us-west-2.neptune.amazonaws.com",
+		"db4.cluster-123456789012.us-west-2.docdb.amazonaws.com",
+	}
+
+	for _, expected := range expectedResults {
+		if !strings.Contains(string(resultsFile), expected) {
+			t.Errorf("Expected %s to be in the results file", expected)
+		}
+	}
+
+}

aws/env-vars.go

@@ -836,7 +836,7 @@ func (m *EnvsModule) interestingEnvVarsOnly() [][]string {
 	for _, envVar := range m.EnvironmentVariables {
 		if envVar.interesting {
 			interestingBody = append(
-				m.output.Body, []string{
+				interestingBody, []string{
 					aws.ToString(m.Caller.Account),
 					envVar.service,
 					envVar.region,

aws/role-trusts.go

@@ -1,21 +1,17 @@
 package aws
 
 import (
-	"encoding/json"
-	"errors"
 	"fmt"
-	"net/url"
 	"path/filepath"
-	"regexp"
 	"sort"
 	"strconv"
 	"strings"
 
 	"github.com/BishopFox/cloudfox/aws/sdk"
 	"github.com/BishopFox/cloudfox/internal"
+	"github.com/BishopFox/cloudfox/internal/aws/policy"
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/iam"
-	"github.com/aws/aws-sdk-go-v2/service/iam/types"
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/bishopfox/knownawsaccountslookup"
 	"github.com/sirupsen/logrus"
@@ -65,46 +61,12 @@ type RoleTrustRow struct {
 
 type AnalyzedRole struct {
 	roleARN   *string
-	trustsDoc trustPolicyDocument
+	trustsDoc policy.TrustPolicyDocument
 	// trustType  string // UNUSED FIELD, PLEASE REVIEW
 	Admin      string
 	CanPrivEsc string
 }
 
-type trustPolicyDocument struct {
-	Version   string                    `json:"Version"`
-	Statement []RoleTrustStatementEntry `json:"Statement"`
-}
-
-type RoleTrustStatementEntry struct {
-	Sid       string `json:"Sid"`
-	Effect    string `json:"Effect"`
-	Principal struct {
-		AWS       ListOfPrincipals `json:"AWS"`
-		Service   ListOfPrincipals `json:"Service"`
-		Federated ListOfPrincipals `json:"Federated"`
-	} `json:"Principal"`
-	Action    string `json:"Action"`
-	Condition struct {
-		StringEquals struct {
-			StsExternalID string `json:"sts:ExternalId"`
-			SAMLAud       string `json:"SAML:aud"`
-			OidcEksSub    string `json:"OidcEksSub"`
-			OidcEksAud    string `json:"OidcEksAud"`
-			CognitoAud    string `json:"cognito-identity.amazonaws.com:aud"`
-		} `json:"StringEquals"`
-		StringLike struct {
-			TokenActionsGithubusercontentComSub ListOfPrincipals `json:"token.actions.githubusercontent.com:sub"`
-			TokenActionsGithubusercontentComAud string           `json:"token.actions.githubusercontent.com:aud"`
-			OidcEksSub                          string           `json:"OidcEksSub"`
-			OidcEksAud                          string           `json:"OidcEksAud"`
-		} `json:"StringLike"`
-		ForAnyValueStringLike struct {
-			CognitoAMR string `json:"cognito-identity.amazonaws.com:amr"`
-		} `json:"ForAnyValue:StringLike"`
-	} `json:"Condition"`
-}
-
 func (m *RoleTrustsModule) PrintRoleTrusts(outputDirectory string, verbosity int) {
 	m.output.Verbosity = verbosity
 	m.output.Directory = outputDirectory
@@ -140,6 +102,7 @@ func (m *RoleTrustsModule) PrintRoleTrusts(outputDirectory string, verbosity int
 
 		}
 	}
+
 	o := internal.OutputClient{
 		Verbosity:     verbosity,
 		CallingModule: m.output.CallingModule,
@@ -189,12 +152,12 @@ func (m *RoleTrustsModule) PrintRoleTrusts(outputDirectory string, verbosity int
 		fmt.Printf("[%s][%s] No role trusts found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
 	}
 	if len(servicesBody) > 0 {
-		fmt.Printf("[%s][%s] %s principal role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(servicesBody)))
+		fmt.Printf("[%s][%s] %s service role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(servicesBody)))
 	} else {
 		fmt.Printf("[%s][%s] No role trusts found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
 	}
 	if len(federatedBody) > 0 {
-		fmt.Printf("[%s][%s] %s principal role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(federatedBody)))
+		fmt.Printf("[%s][%s] %s federated role trusts found.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile), strconv.Itoa(len(federatedBody)))
 	} else {
 		fmt.Printf("[%s][%s] No role trusts found, skipping the creation of an output file.\n", cyan(m.output.CallingModule), cyan(m.AWSProfile))
 	}
@@ -241,33 +204,34 @@ func (m *RoleTrustsModule) printPrincipalTrusts(outputDirectory string) ([]strin
 	for _, role := range m.AnalyzedRoles {
 		for _, statement := range role.trustsDoc.Statement {
 			for _, principal := range statement.Principal.AWS {
-				if strings.Contains(principal, ":root") {
-					//check to see if the accountID is known
+				//check to see if the accountID is known
+				if strings.Contains(principal, "arn:aws:iam::") || strings.Contains(principal, "root") {
 					accountID := strings.Split(principal, ":")[4]
 					vendorName := m.vendors.GetVendorNameFromAccountID(accountID)
 					if vendorName != "" {
 						principal = fmt.Sprintf("%s (%s)", principal, vendorName)
 					}
-
-					RoleTrustRow := RoleTrustRow{
-						RoleARN:          aws.ToString(role.roleARN),
-						RoleName:         GetResourceNameFromArn(aws.ToString(role.roleARN)),
-						TrustedPrincipal: principal,
-						ExternalID:       statement.Condition.StringEquals.StsExternalID,
-						IsAdmin:          role.Admin,
-						CanPrivEsc:       role.CanPrivEsc,
-					}
-					body = append(body, []string{
-						aws.ToString(m.Caller.Account),
-						RoleTrustRow.RoleARN,
-						RoleTrustRow.RoleName,
-						RoleTrustRow.TrustedPrincipal,
-						RoleTrustRow.ExternalID,
-						RoleTrustRow.IsAdmin,
-						RoleTrustRow.CanPrivEsc})
 				}
+
+				RoleTrustRow := RoleTrustRow{
+					RoleARN:          aws.ToString(role.roleARN),
+					RoleName:         GetResourceNameFromArn(aws.ToString(role.roleARN)),
+					TrustedPrincipal: principal,
+					ExternalID:       statement.Condition.StringEquals.StsExternalID,
+					IsAdmin:          role.Admin,
+					CanPrivEsc:       role.CanPrivEsc,
+				}
+				body = append(body, []string{
+					aws.ToString(m.Caller.Account),
+					RoleTrustRow.RoleARN,
+					RoleTrustRow.RoleName,
+					RoleTrustRow.TrustedPrincipal,
+					RoleTrustRow.ExternalID,
+					RoleTrustRow.IsAdmin,
+					RoleTrustRow.CanPrivEsc})
 			}
 		}
+
 	}
 
 	m.sortTrustsTablePerTrustedPrincipal()
@@ -372,7 +336,7 @@ func (m *RoleTrustsModule) printServiceTrusts(outputDirectory string) ([]string,
 		tableCols = strings.Split(m.AWSTableCols, ",")
 		// If the user specified wide as the output format, use these columns.
 	} else if m.AWSOutputType == "wide" {
-		tableCols = []string{"Role Arn", "Trusted Service", "IsAdmin?", "CanPrivEscToAdmin?"}
+		tableCols = []string{"Account", "Role Arn", "Trusted Service", "IsAdmin?", "CanPrivEscToAdmin?"}
 		// Otherwise, use the default columns for this module (brief)
 	} else {
 		tableCols = []string{"Role Name", "Trusted Service", "IsAdmin?", "CanPrivEscToAdmin?"}
@@ -440,7 +404,7 @@ func (m *RoleTrustsModule) printFederatedTrusts(outputDirectory string) ([]strin
 		tableCols = strings.Split(m.AWSTableCols, ",")
 		// If the user specified wide as the output format, use these columns.
 	} else if m.AWSOutputType == "wide" {
-		tableCols = []string{"Role Arn", "Trusted Provider", "Trusted Subject", "IsAdmin?", "CanPrivEscToAdmin?"}
+		tableCols = []string{"Account", "Role Arn", "Trusted Provider", "Trusted Subject", "IsAdmin?", "CanPrivEscToAdmin?"}
 		// Otherwise, use the default columns for this module (brief)
 	} else {
 		tableCols = []string{"Role Name", "Trusted Provider", "Trusted Subject", "IsAdmin?", "CanPrivEscToAdmin?"}
@@ -453,23 +417,25 @@ func (m *RoleTrustsModule) printFederatedTrusts(outputDirectory string) ([]strin
 	for _, role := range m.AnalyzedRoles {
 		for _, statement := range role.trustsDoc.Statement {
 			if len(statement.Principal.Federated) > 0 {
-				provider, subject := parseFederatedTrustPolicy(statement)
-				RoleTrustRow := RoleTrustRow{
-					RoleARN:                  aws.ToString(role.roleARN),
-					RoleName:                 GetResourceNameFromArn(aws.ToString(role.roleARN)),
-					TrustedFederatedProvider: provider,
-					TrustedFederatedSubject:  subject,
-					IsAdmin:                  role.Admin,
-					CanPrivEsc:               role.CanPrivEsc,
+				provider, subjects := parseFederatedTrustPolicy(statement)
+				for _, subject := range subjects {
+					RoleTrustRow := RoleTrustRow{
+						RoleARN:                  aws.ToString(role.roleARN),
+						RoleName:                 GetResourceNameFromArn(aws.ToString(role.roleARN)),
+						TrustedFederatedProvider: provider,
+						TrustedFederatedSubject:  subject,
+						IsAdmin:                  role.Admin,
+						CanPrivEsc:               role.CanPrivEsc,
+					}
+					body = append(body, []string{
+						aws.ToString(m.Caller.Account),
+						RoleTrustRow.RoleARN,
+						RoleTrustRow.RoleName,
+						RoleTrustRow.TrustedFederatedProvider,
+						RoleTrustRow.TrustedFederatedSubject,
+						RoleTrustRow.IsAdmin,
+						RoleTrustRow.CanPrivEsc})
 				}
-				body = append(body, []string{
-					aws.ToString(m.Caller.Account),
-					RoleTrustRow.RoleARN,
-					RoleTrustRow.RoleName,
-					RoleTrustRow.TrustedFederatedProvider,
-					RoleTrustRow.TrustedFederatedSubject,
-					RoleTrustRow.IsAdmin,
-					RoleTrustRow.CanPrivEsc})
 			}
 
 		}
@@ -480,47 +446,120 @@ func (m *RoleTrustsModule) printFederatedTrusts(outputDirectory string) ([]strin
 
 }
 
-func parseFederatedTrustPolicy(statement RoleTrustStatementEntry) (string, string) {
-	var column2, column3 string
-	if statement.Condition.StringLike.TokenActionsGithubusercontentComAud != "" || len(statement.Condition.StringLike.TokenActionsGithubusercontentComSub) > 0 {
-		column2 = "GitHub Actions" //  (" + statement.Principal.Federated[0] + ")"
-		trustedRepos := strings.Join(statement.Condition.StringLike.TokenActionsGithubusercontentComSub, "\n")
-		if trustedRepos == "" {
-			column3 = "ALL REPOS!!!"
+func parseFederatedTrustPolicy(statement policy.RoleTrustStatementEntry) (string, []string) {
+	var provider string
+	var subjects []string
+	if len(statement.Principal.Federated) > 1 {
+		sharedLogger.Warnf("Multiple federated providers found in the trust policy. This is not currently supported. Please review the trust policy for specifics.")
+		provider = "Multiple Federated Providers"
+		subjects = append(subjects, "Review policy for specifics\nand submit issue to cloudfox repo.")
+	}
+
+	switch {
+	// lets use the Federated field to determine the provider, then based on the provider we can grab the list of subjects
+	case strings.Contains(statement.Principal.Federated[0], "token.actions.githubusercontent.com"):
+		provider = "GitHub"
+		if len(statement.Condition.StringLike.TokenActionsGithubusercontentComSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringLike.TokenActionsGithubusercontentComSub...)
+		} else if len(statement.Condition.StringEquals.TokenActionsGithubusercontentComSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringEquals.TokenActionsGithubusercontentComSub...)
 		} else {
-			column3 = trustedRepos
+			subjects = append(subjects, "ALL REPOS!!!")
 		}
-	} else if statement.Condition.StringEquals.SAMLAud == "https://signin.aws.amazon.com/saml" {
-		if strings.Contains(statement.Principal.Federated[0], "AWSSSO") {
-			column2 = "AWS SSO" // (" + statement.Principal.Federated[0] + ")"
-		} else if strings.Contains(statement.Principal.Federated[0], "Okta") {
-			column2 = "Okta" //  (" + statement.Principal.Federated[0] + ")"
-		}
-		column3 = "Not applicable"
-	} else if statement.Condition.StringEquals.OidcEksAud != "" || statement.Condition.StringEquals.OidcEksSub != "" || statement.Condition.StringLike.OidcEksAud != "" || statement.Condition.StringLike.OidcEksSub != "" {
-		column2 = "EKS" // (" + statement.Principal.Federated[0] + ")"
-		if statement.Condition.StringEquals.OidcEksSub != "" {
-			column3 = statement.Condition.StringEquals.OidcEksSub
-		} else if statement.Condition.StringLike.OidcEksSub != "" {
-			column3 = statement.Condition.StringLike.OidcEksSub
+	case strings.Contains(statement.Principal.Federated[0], "oidc.eks"):
+		provider = "EKS"
+		if len(statement.Condition.StringLike.OidcEksSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringLike.OidcEksSub...)
+		} else if len(statement.Condition.StringEquals.OidcEksSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringEquals.OidcEksSub...)
 		} else {
-			column3 = "ALL SERVICE ACCOUNTS!"
+			subjects = append(subjects, "ALL SERVICE ACCOUNTS!!!")
 		}
-	} else if statement.Principal.Federated[0] == "cognito-identity.amazonaws.com" {
-		column2 = "Cognito" // (" + statement.Principal.Federated[0] + ")"
-		if statement.Condition.ForAnyValueStringLike.CognitoAMR != "" {
-			column3 = statement.Condition.ForAnyValueStringLike.CognitoAMR
+		// terraform case
+	case strings.Contains(statement.Principal.Federated[0], "app.terraform.io"):
+		provider = "Terraform Cloud"
+		if len(statement.Condition.StringLike.TerraformSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringLike.TerraformSub...)
+		} else if len(statement.Condition.StringEquals.TerraformSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringEquals.TerraformSub...)
+		} else {
+			subjects = append(subjects, "ALL WORKSPACES")
 		}
-	} else {
-		if column2 == "" && strings.Contains(statement.Principal.Federated[0], "oidc.eks") {
-			column2 = "EKS" // (" + statement.Principal.Federated[0] + ")"
-			column3 = "ALL SERVICE ACCOUNTS!"
-		} else if column2 == "" && strings.Contains(statement.Principal.Federated[0], "AWSSSO") {
-			column2 = "AWS SSO" // (" + statement.Principal.Federated[0] + ")"
+		// Azure AD case
+	case strings.Contains(statement.Principal.Federated[0], "http://sts.windows.net"):
+		provider = "Azure AD"
+		if len(statement.Condition.StringLike.AzureADIss) > 0 {
+			subjects = append(subjects, statement.Condition.StringLike.AzureADIss...)
+		} else if len(statement.Condition.StringEquals.AzureADIss) > 0 {
+			subjects = append(subjects, statement.Condition.StringEquals.AzureADIss...)
+		} else {
+			subjects = append(subjects, "ALL ISSUERS")
 		}
 
+	// AWS SSO case
+	case strings.Contains(statement.Principal.Federated[0], "AWSSSO"):
+		provider = "AWS SSO"
+		subjects = append(subjects, "Not applicable")
+
+	// okta case
+	case strings.Contains(statement.Principal.Federated[0], "Okta"):
+		provider = "Okta"
+		subjects = append(subjects, "Not applicable")
+
+	// cognito case
+	case statement.Principal.Federated[0] == "cognito-identity.amazonaws.com":
+		provider = "Cognito"
+		if statement.Condition.ForAnyValueStringLike.CognitoAMR != "" {
+			subjects = append(subjects, statement.Condition.ForAnyValueStringLike.CognitoAMR)
+		} else {
+			subjects = append(subjects, "ALL IDENTITIES")
+		}
+		// google workspace case
+	case strings.Contains(statement.Principal.Federated[0], "workspace.google.com"):
+		provider = "Google Workspace"
+		if len(statement.Condition.StringLike.GoogleWorkspaceSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringLike.GoogleWorkspaceSub...)
+		} else if len(statement.Condition.StringEquals.GoogleWorkspaceSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringEquals.GoogleWorkspaceSub...)
+		} else {
+			subjects = append(subjects, "ALL USERS")
+		}
+		// GCP case
+	case strings.Contains(statement.Principal.Federated[0], "accounts.google.com"):
+		provider = "GCP"
+		if len(statement.Condition.StringLike.GCPSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringLike.GCPSub...)
+		} else if len(statement.Condition.StringEquals.GCPSub) > 0 {
+			subjects = append(subjects, statement.Condition.StringEquals.GCPSub...)
+		} else {
+			subjects = append(subjects, "ALL USERS")
+		}
+	// auth0 case
+	//not ready yet
+	// case strings.Contains(statement.Principal.Federated[0], "auth0.com"):
+	// 	provider = "Auth0"
+	// 	if len(statement.Condition.ForAnyValueStringLike.Auth0Amr) > 0 {
+	// 		subjects = append(subjects, statement.Condition.ForAnyValueStringLike.Auth0Amr...)
+	// 	} else {
+	// 		subjects = append(subjects, "ALL GROUPS")
+	// 	}
+	// circleci case
+	case strings.Contains(statement.Principal.Federated[0], "oidc.circleci.com"):
+		provider = "CircleCI"
+		if len(statement.Condition.StringLike.CircleCIAud) > 0 {
+			subjects = append(subjects, statement.Condition.StringLike.CircleCIAud...)
+		} else if len(statement.Condition.StringEquals.CircleCIAud) > 0 {
+			subjects = append(subjects, statement.Condition.StringEquals.CircleCIAud...)
+		} else {
+			subjects = append(subjects, "ALL PROJECTS")
+		}
+
+	default:
+		provider = "Unknown Federated Provider"
+		subjects = append(subjects, "Review policy for specifics\nand submit issue to cloudfox repo.")
+
 	}
-	return column2, column3
+	return provider, subjects
 }
 
 func (m *RoleTrustsModule) sortTrustsTablePerTrustedPrincipal() {
@@ -540,7 +579,7 @@ func (m *RoleTrustsModule) getAllRoleTrusts() {
 	}
 
 	for _, role := range ListRoles {
-		trustsdoc, err := parseRoleTrustPolicyDocument(role)
+		trustsdoc, err := policy.ParseRoleTrustPolicyDocument(role)
 		if err != nil {
 			m.modLog.Error(err.Error())
 			m.CommandCounter.Error++
@@ -560,40 +599,3 @@ func (m *RoleTrustsModule) getAllRoleTrusts() {
 	}
 
 }
-
-func parseRoleTrustPolicyDocument(role types.Role) (trustPolicyDocument, error) {
-	document, _ := url.QueryUnescape(aws.ToString(role.AssumeRolePolicyDocument))
-
-	// These next six lines are a hack, needed because the EKS OIDC json field name is dynamic
-	// and therefore can't be used to unmarshall in a predictable way. The hack involves replacing
-	// the random pattern with a predictable one so that we can add the predictable one in the struct
-	// used to unmarshall.
-	pattern := `(\w+)\:`
-	pattern2 := `".[a-zA-Z0-9\-\.]+/id/`
-	var reEKSSub = regexp.MustCompile(pattern2 + pattern + "sub")
-	var reEKSAud = regexp.MustCompile(pattern2 + pattern + "aud")
-	document = reEKSSub.ReplaceAllString(document, "\"OidcEksSub")
-	document = reEKSAud.ReplaceAllString(document, "\"OidcEksAud")
-
-	var parsedDocumentToJSON trustPolicyDocument
-	_ = json.Unmarshal([]byte(document), &parsedDocumentToJSON)
-	return parsedDocumentToJSON, nil
-}
-
-// A custom unmarshaller is necessary because the list of principals can be an array of strings or a string.
-// https://stackoverflow.com/questions/65854778/parsing-arn-from-iam-policy-using-regex
-type ListOfPrincipals []string
-
-func (r *ListOfPrincipals) UnmarshalJSON(b []byte) error {
-	var s string
-	if err := json.Unmarshal(b, &s); err == nil {
-		*r = append(*r, s)
-		return nil
-	}
-	var ss []string
-	if err := json.Unmarshal(b, &ss); err == nil {
-		*r = ss
-		return nil
-	}
-	return errors.New("cannot unmarshal neither to a string nor a slice of strings")
-}

aws/sdk/apigateway.go

@@ -9,6 +9,7 @@ import (
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/apigateway"
 	apiGatewayTypes "github.com/aws/aws-sdk-go-v2/service/apigateway/types"
+	"github.com/patrickmn/go-cache"
 )
 
 type APIGatewayClientInterface interface {
@@ -22,13 +23,32 @@ type APIGatewayClientInterface interface {
 	GetUsagePlanKeys(context.Context, *apigateway.GetUsagePlanKeysInput, ...func(*apigateway.Options)) (*apigateway.GetUsagePlanKeysOutput, error)
 }
 
+type CachedGetMethodOutput struct {
+	ApiKeyRequired      *bool
+	AuthorizationScopes []string
+	AuthorizationType   *string
+	AuthorizerId        *string
+	HttpMethod          *string
+	MethodIntegration   *apiGatewayTypes.Integration
+	MethodResponses     map[string]apiGatewayTypes.MethodResponse
+	OperationName       *string
+	RequestModels       map[string]string
+	RequestParameters   map[string]bool
+	RequestValidatorId  *string
+	ResourceId          *string
+}
+
+type CachedGetStagesOutput struct {
+	Item []apiGatewayTypes.Stage
+}
+
 func init() {
 	gob.Register([]apiGatewayTypes.RestApi{})
-	gob.Register(apigateway.GetStagesOutput{})
+	gob.Register(CachedGetStagesOutput{})
 	gob.Register([]apiGatewayTypes.Resource{})
 	gob.Register([]apiGatewayTypes.DomainName{})
 	gob.Register([]apiGatewayTypes.BasePathMapping{})
-	gob.Register(apigateway.GetMethodOutput{})
+	gob.Register(CachedGetMethodOutput{})
 	gob.Register([]apiGatewayTypes.UsagePlan{})
 	gob.Register([]apiGatewayTypes.UsagePlanKey{})
 }
@@ -66,16 +86,18 @@ func CachedApiGatewayGetRestAPIs(client APIGatewayClientInterface, accountID str
 		}
 		PaginationControl = GetRestApis.Position
 	}
-
+	internal.Cache.Set(cacheKey, restAPIs, cache.DefaultExpiration)
 	return restAPIs, nil
 }
 
 // create a CachedApiGatewayGetStages function that accepts a client, account id, region, and rest api id. Make sure it handles caching, the region option and pagination
-func CachedApiGatewayGetStages(client APIGatewayClientInterface, accountID string, region string, restAPIID string) (apigateway.GetStagesOutput, error) {
+func CachedApiGatewayGetStages(client APIGatewayClientInterface, accountID string, region string, restAPIID string) (*apigateway.GetStagesOutput, error) {
 	cacheKey := fmt.Sprintf("%s-apigateway-GetStages-%s-%s", accountID, region, restAPIID)
 	cached, found := internal.Cache.Get(cacheKey)
 	if found {
-		return cached.(apigateway.GetStagesOutput), nil
+		// Convert cached data back to GetStagesOutput before returning
+		cachedOutput := cached.(*CachedGetStagesOutput) // Ensure this type assertion matches your caching logic
+		return fromCachedGetStagesOutput(cachedOutput), nil
 	}
 
 	GetStages, err := client.GetStages(
@@ -89,10 +111,28 @@ func CachedApiGatewayGetStages(client APIGatewayClientInterface, accountID strin
 	)
 
 	if err != nil {
-		return apigateway.GetStagesOutput{}, err
+		return &apigateway.GetStagesOutput{}, err
 	}
 
-	return *GetStages, err
+	// Convert GetStagesOutput to CachedGetStagesOutput before caching
+	cachedVersion := toCachedGetStagesOutput(GetStages)
+	internal.Cache.Set(cacheKey, cachedVersion, cache.DefaultExpiration)
+	return GetStages, err
+}
+
+// Convert from AWS SDK type to custom type for caching
+func toCachedGetStagesOutput(gso *apigateway.GetStagesOutput) *CachedGetStagesOutput {
+	return &CachedGetStagesOutput{
+		Item: gso.Item,
+	}
+}
+
+// Convert back to AWS SDK type after fetching from cache
+func fromCachedGetStagesOutput(cgso *CachedGetStagesOutput) *apigateway.GetStagesOutput {
+	return &apigateway.GetStagesOutput{
+		Item: cgso.Item,
+		// Initialize ResultMetadata or leave it as zero value if it's not required for your use case
+	}
 }
 
 // create a CachedApiGatewayGetResources function that accepts a client, account id, region, and rest api id. Make sure it handles caching, the region option and pagination
@@ -129,7 +169,7 @@ func CachedApiGatewayGetResources(client APIGatewayClientInterface, accountID st
 		}
 		PaginationControl = GetResources.Position
 	}
-
+	internal.Cache.Set(cacheKey, resources, cache.DefaultExpiration)
 	return resources, nil
 }
 
@@ -166,7 +206,7 @@ func CachedApiGatewayGetDomainNames(client APIGatewayClientInterface, accountID
 		}
 		PaginationControl = GetDomainNames.Position
 	}
-
+	internal.Cache.Set(cacheKey, domainNames, cache.DefaultExpiration)
 	return domainNames, nil
 }
 
@@ -204,17 +244,19 @@ func CachedApiGatewayGetBasePathMappings(client APIGatewayClientInterface, accou
 		}
 		PaginationControl = GetBasePathMappings.Position
 	}
-
+	internal.Cache.Set(cacheKey, basePathMappings, cache.DefaultExpiration)
 	return basePathMappings, nil
 }
 
 // create a CachedApiGatewayGetMethod function that accepts a client, account id, region, rest api id, and resource id. Make sure it handles caching, the region option and pagination if needed
-func CachedApiGatewayGetMethod(client APIGatewayClientInterface, accountID string, region string, restAPIID string, resourceID string, method string) (apigateway.GetMethodOutput, error) {
+func CachedApiGatewayGetMethod(client APIGatewayClientInterface, accountID string, region string, restAPIID string, resourceID string, method string) (*apigateway.GetMethodOutput, error) {
 
 	cacheKey := fmt.Sprintf("%s-apigateway-GetMethod-%s-%s-%s-%s", accountID, region, restAPIID, resourceID, method)
 	cached, found := internal.Cache.Get(cacheKey)
 	if found {
-		return cached.(apigateway.GetMethodOutput), nil
+		// Convert cached data back to GetMethodOutput before returning
+		cachedOutput := cached.(*CachedGetMethodOutput) // Ensure this type assertion matches your caching logic
+		return fromCachedGetMethodOutput(cachedOutput), nil
 	}
 
 	GetMethod, err := client.GetMethod(
@@ -230,13 +272,51 @@ func CachedApiGatewayGetMethod(client APIGatewayClientInterface, accountID strin
 	)
 
 	if err != nil {
-		return apigateway.GetMethodOutput{}, err
+		return &apigateway.GetMethodOutput{}, err
 	}
 
-	return *GetMethod, nil
+	// Convert GetMethodOutput to CachedGetMethodOutput before caching
+	cachedVersion := toCachedGetMethodOutput(GetMethod)
+	internal.Cache.Set(cacheKey, cachedVersion, cache.DefaultExpiration)
+	return GetMethod, nil
 
 }
 
+// Convert from AWS SDK type to custom type for caching
+func toCachedGetMethodOutput(gmo *apigateway.GetMethodOutput) *CachedGetMethodOutput {
+	return &CachedGetMethodOutput{
+		ApiKeyRequired:      gmo.ApiKeyRequired,
+		AuthorizationScopes: gmo.AuthorizationScopes,
+		AuthorizationType:   gmo.AuthorizationType,
+		AuthorizerId:        gmo.AuthorizerId,
+		HttpMethod:          gmo.HttpMethod,
+		MethodIntegration:   gmo.MethodIntegration,
+		MethodResponses:     gmo.MethodResponses,
+		OperationName:       gmo.OperationName,
+		RequestModels:       gmo.RequestModels,
+		RequestParameters:   gmo.RequestParameters,
+		RequestValidatorId:  gmo.RequestValidatorId,
+	}
+}
+
+// Convert back to AWS SDK type after fetching from cache
+func fromCachedGetMethodOutput(cgmo *CachedGetMethodOutput) *apigateway.GetMethodOutput {
+	return &apigateway.GetMethodOutput{
+		ApiKeyRequired:      cgmo.ApiKeyRequired,
+		AuthorizationScopes: cgmo.AuthorizationScopes,
+		AuthorizationType:   cgmo.AuthorizationType,
+		AuthorizerId:        cgmo.AuthorizerId,
+		HttpMethod:          cgmo.HttpMethod,
+		MethodIntegration:   cgmo.MethodIntegration,
+		MethodResponses:     cgmo.MethodResponses,
+		OperationName:       cgmo.OperationName,
+		RequestModels:       cgmo.RequestModels,
+		RequestParameters:   cgmo.RequestParameters,
+		RequestValidatorId:  cgmo.RequestValidatorId,
+		// ResultMetadata: This will be missing or zero value; handle accordingly
+	}
+}
+
 // create a CachedApiGatewayGetUsagePlans function that accepts a client, account id, region. Make sure it handles caching, the region option and pagination if needed
 func CachedApiGatewayGetUsagePlans(client APIGatewayClientInterface, accountID string, region string) ([]apiGatewayTypes.UsagePlan, error) {
 	var PaginationControl *string
@@ -271,6 +351,7 @@ func CachedApiGatewayGetUsagePlans(client APIGatewayClientInterface, accountID s
 		PaginationControl = GetUsagePlans.Position
 	}
 
+	internal.Cache.Set(cacheKey, usagePlans, cache.DefaultExpiration)
 	return usagePlans, nil
 }
 
@@ -309,5 +390,6 @@ func CachedApiGatewayGetUsagePlanKeys(client APIGatewayClientInterface, accountI
 		PaginationControl = GetUsagePlanKeys.Position
 	}
 
+	internal.Cache.Set(cacheKey, usagePlanKeys, cache.DefaultExpiration)
 	return usagePlanKeys, nil
 }

aws/sdk/apigatewayv2.go

@@ -21,13 +21,14 @@ type APIGatewayv2ClientInterface interface {
 }
 
 type domainName apiGatwayV2Types.DomainName
+type stage apiGatwayV2Types.Stage
 
 func init() {
 	gob.Register([]apiGatwayV2Types.Api{})
 	//need to do this to avoid conflicts with the Instance type in the ec2 package
 	gob.Register([]domainName{})
 	gob.Register([]apiGatwayV2Types.ApiMapping{})
-	gob.Register([]apiGatwayV2Types.Stage{})
+	gob.Register([]stage{})
 	gob.Register([]apiGatwayV2Types.Route{})
 }
 

aws/sdk/docdb.go

@@ -21,7 +21,7 @@ type DocDBClientInterface interface {
 
 func init() {
 	gob.Register([]docdbTypes.GlobalCluster{})
-	gob.Register([]docdbTypes.DBCluster{})
+	//gob.Register([]docdbTypes.DBCluster{})
 	//gob.Register([]docdbTypes.DBInstance{})
 
 }

aws/sdk/dynamodb_mocks.go

@@ -10,10 +10,6 @@ import (
 type MockedAWSDynamoDBClient struct {
 }
 
-func (m *MockedAWSDynamoDBClient) ListTables() ([]string, error) {
-	return []string{"table1", "table2"}, nil
-}
-
 func (m *MockedAWSDynamoDBClient) DescribeTable(ctx context.Context, input *dynamodb.DescribeTableInput, options ...func(*dynamodb.Options)) (*dynamodb.DescribeTableOutput, error) {
 	return &dynamodb.DescribeTableOutput{
 		Table: &dynamodbTypes.TableDescription{
@@ -21,3 +17,9 @@ func (m *MockedAWSDynamoDBClient) DescribeTable(ctx context.Context, input *dyna
 		},
 	}, nil
 }
+
+func (m *MockedAWSDynamoDBClient) ListTables(ctx context.Context, input *dynamodb.ListTablesInput, options ...func(*dynamodb.Options)) (*dynamodb.ListTablesOutput, error) {
+	return &dynamodb.ListTablesOutput{
+		TableNames: []string{"table1", "table2"},
+	}, nil
+}

aws/sdk/rds.go

@@ -14,10 +14,13 @@ import (
 
 type RDSClientInterface interface {
 	DescribeDBInstances(context.Context, *rds.DescribeDBInstancesInput, ...func(*rds.Options)) (*rds.DescribeDBInstancesOutput, error)
+	DescribeDBClusters(context.Context, *rds.DescribeDBClustersInput, ...func(*rds.Options)) (*rds.DescribeDBClustersOutput, error)
 }
 
 func init() {
 	gob.Register([]rdsTypes.DBInstance{})
+	gob.Register([]rdsTypes.DBCluster{})
+
 }
 
 func CachedRDSDescribeDBInstances(client RDSClientInterface, accountID string, region string) ([]rdsTypes.DBInstance, error) {
@@ -55,3 +58,39 @@ func CachedRDSDescribeDBInstances(client RDSClientInterface, accountID string, r
 	internal.Cache.Set(cacheKey, instances, cache.DefaultExpiration)
 	return instances, nil
 }
+
+func CachedRDSDescribeDBClusters(client RDSClientInterface, accountID string, region string) ([]rdsTypes.DBCluster, error) {
+	var PaginationControl *string
+	var clusters []rdsTypes.DBCluster
+	cacheKey := fmt.Sprintf("%s-rds-DescribeDBClusters-%s", accountID, region)
+	cached, found := internal.Cache.Get(cacheKey)
+	if found {
+		return cached.([]rdsTypes.DBCluster), nil
+	}
+	for {
+		DescribeDBClusters, err := client.DescribeDBClusters(
+			context.TODO(),
+			&rds.DescribeDBClustersInput{
+				Marker: PaginationControl,
+			},
+			func(o *rds.Options) {
+				o.Region = region
+			},
+		)
+
+		if err != nil {
+			return clusters, err
+		}
+
+		clusters = append(clusters, DescribeDBClusters.DBClusters...)
+
+		//pagination
+		if DescribeDBClusters.Marker == nil {
+			break
+		}
+		PaginationControl = DescribeDBClusters.Marker
+	}
+
+	internal.Cache.Set(cacheKey, clusters, cache.DefaultExpiration)
+	return clusters, nil
+}

aws/sdk/rds_mocks.go

@@ -9,10 +9,10 @@ import (
 	rdsTypes "github.com/aws/aws-sdk-go-v2/service/rds/types"
 )
 
-type MOckedRDSClient struct {
+type MockedRDSClient struct {
 }
 
-func (m *MOckedRDSClient) DescribeDBInstances(ctx context.Context, input *rds.DescribeDBInstancesInput, options ...func(*rds.Options)) (*rds.DescribeDBInstancesOutput, error) {
+func (m *MockedRDSClient) DescribeDBInstances(ctx context.Context, input *rds.DescribeDBInstancesInput, options ...func(*rds.Options)) (*rds.DescribeDBInstancesOutput, error) {
 	return &rds.DescribeDBInstancesOutput{
 		DBInstances: []rdsTypes.DBInstance{
 			{
@@ -32,3 +32,53 @@ func (m *MOckedRDSClient) DescribeDBInstances(ctx context.Context, input *rds.De
 		},
 	}, nil
 }
+
+func (m *MockedRDSClient) DescribeDBClusters(ctx context.Context, input *rds.DescribeDBClustersInput, options ...func(*rds.Options)) (*rds.DescribeDBClustersOutput, error) {
+	return &rds.DescribeDBClustersOutput{
+		DBClusters: []rdsTypes.DBCluster{
+			{
+				DBClusterIdentifier: aws.String("db1"),
+				Engine:              aws.String("aurora-postgresql"),
+				EngineVersion:       aws.String("13.3"),
+				Endpoint:            aws.String("db1.cluster-123456789012.us-west-2.rds.amazonaws.com"),
+				ClusterCreateTime:   aws.Time(time.Now()),
+				MasterUsername:      aws.String("postgres"),
+				Port:                aws.Int32(5432),
+				AssociatedRoles:     nil,
+			},
+			{
+				DBClusterIdentifier: aws.String("db2"),
+				Engine:              aws.String("aurora-postgresql"),
+				EngineVersion:       aws.String("13.3"),
+				Endpoint:            aws.String("db2.cluster-123456789012.us-west-2.rds.amazonaws.com"),
+				ClusterCreateTime:   aws.Time(time.Now()),
+				MasterUsername:      aws.String("postgres"),
+				Port:                aws.Int32(5432),
+				AssociatedRoles:     nil,
+			},
+			{
+				DBClusterIdentifier: aws.String("db3"),
+				Engine:              aws.String("neptune"),
+				EngineVersion:       aws.String("1.2.1.0"),
+				Endpoint:            aws.String("db3.cluster-123456789012.us-west-2.neptune.amazonaws.com"),
+				MasterUsername:      aws.String("neptune"),
+				Port:                aws.Int32(8182),
+				AssociatedRoles: []rdsTypes.DBClusterRole{
+					{
+						RoleArn: aws.String("arn:aws:iam::123456789012:role/NeptuneRole"),
+						Status:  aws.String("active"),
+					},
+				},
+			},
+			{
+				DBClusterIdentifier: aws.String("db4"),
+				Engine:              aws.String("docsdb"),
+				EngineVersion:       aws.String("4.0.0"),
+				Endpoint:            aws.String("db4.cluster-123456789012.us-west-2.docdb.amazonaws.com"),
+				MasterUsername:      aws.String("docsdb"),
+				Port:                aws.Int32(27017),
+				AssociatedRoles:     nil,
+			},
+		},
+	}, nil
+}

cli/aws.go

@@ -23,7 +23,6 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/codecommit"
 	"github.com/aws/aws-sdk-go-v2/service/codedeploy"
 	"github.com/aws/aws-sdk-go-v2/service/datapipeline"
-	"github.com/aws/aws-sdk-go-v2/service/docdb"
 	"github.com/aws/aws-sdk-go-v2/service/dynamodb"
 	"github.com/aws/aws-sdk-go-v2/service/ec2"
 	"github.com/aws/aws-sdk-go-v2/service/ecr"
@@ -156,7 +155,7 @@ var (
 	DatabasesCommand = &cobra.Command{
 		Use:     "databases",
 		Aliases: []string{"db", "rds", "redshift", "dbs"},
-		Short:   "Enumerate RDS databases. Get a loot file with connection strings.",
+		Short:   "Enumerate databases. Get a loot file with connection strings.",
 		Long: "\nUse case examples:\n" +
 			os.Args[0] + " aws databases --profile readonly_profile",
 		PreRun:  awsPreRun,
@@ -740,7 +739,6 @@ func runDatabasesCommand(cmd *cobra.Command, args []string) {
 			RDSClient:      rds.NewFromConfig(AWSConfig),
 			RedshiftClient: redshift.NewFromConfig(AWSConfig),
 			DynamoDBClient: dynamodb.NewFromConfig(AWSConfig),
-			DocDBClient:    docdb.NewFromConfig(AWSConfig),
 			Caller:         *caller,
 			AWSRegions:     internal.GetEnabledRegions(profile, cmd.Root().Version, AWSMFAToken),
 			AWSProfile:     profile,
@@ -1396,7 +1394,6 @@ func runAllChecksCommand(cmd *cobra.Command, args []string) {
 		codeCommitClient := codecommit.NewFromConfig(AWSConfig)
 		codeDeployClient := codedeploy.NewFromConfig(AWSConfig)
 		dataPipelineClient := datapipeline.NewFromConfig(AWSConfig)
-		docdbClient := docdb.NewFromConfig(AWSConfig)
 		dynamodbClient := dynamodb.NewFromConfig(AWSConfig)
 		ec2Client := ec2.NewFromConfig(AWSConfig)
 		ecrClient := ecr.NewFromConfig(AWSConfig)
@@ -1605,7 +1602,6 @@ func runAllChecksCommand(cmd *cobra.Command, args []string) {
 			RDSClient:      rdsClient,
 			RedshiftClient: redshiftClient,
 			DynamoDBClient: dynamodbClient,
-			DocDBClient:    docdbClient,
 			Caller:         *caller,
 			AWSProfile:     profile,
 			AWSRegions:     internal.GetEnabledRegions(profile, cmd.Root().Version, AWSMFAToken),

cli/gcp.go

@@ -0,0 +1,109 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/BishopFox/cloudfox/gcp/commands"
+	oauthservice "github.com/BishopFox/cloudfox/gcp/services/oauthService"
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/spf13/cobra"
+)
+
+var (
+	// GCP resources filtering options
+	GCPOrganization       string
+	GCPProjectID          string
+	GCPProjectIDsFilePath string
+	GCPProjectIDs         []string
+
+	// Output formatting options
+	GCPOutputFormat    string
+	GCPOutputDirectory string
+	GCPVerbosity       int
+	GCPWrapTable       bool
+
+	// misc options
+	// GCPIgnoreCache		bool
+
+	// logger
+	GCPLogger = internal.NewLogger()
+
+	// GCP root command
+	GCPCommands = &cobra.Command{
+		Use:     "gcp",
+		Aliases: []string{"gcloud"},
+		Long:    `See "Available Commands" for GCP Modules below`,
+		Short:   "See \"Available Commands\" for GCP Modules below",
+		PersistentPreRun: func(cmd *cobra.Command, args []string) {
+			if GCPProjectID != "" {
+				GCPProjectIDs = append(GCPProjectIDs, GCPProjectID)
+			} else if GCPProjectIDsFilePath != "" {
+				GCPProjectIDs = internal.LoadFileLinesIntoArray(GCPProjectIDsFilePath)
+			} else {
+				GCPLogger.InfoM("project or project-list flags not given, commands requiring a project ID will fail", "gcp")
+			}
+			// Create a context with this value to share it with subcommands at runtime
+			ctx := context.WithValue(context.Background(), "projectIDs", GCPProjectIDs)
+
+			// Set the context for this command which all subcommands can access via [SUBCMD].Parent().Context()
+			// cmd.SetContext(ctx)
+			os := oauthservice.NewOAuthService()
+			principal, err := os.WhoAmI()
+			if err != nil {
+				GCPLogger.FatalM(fmt.Sprintf("could not determine default user credential with error %s. \n\nPlease use default application default credentials: https://cloud.google.com/docs/authentication/application-default-credentials", err.Error()), "gcp")
+			}
+			ctx = context.WithValue(ctx, "account", principal.Email)
+			cmd.SetContext(ctx)
+		},
+	}
+)
+
+// New RunAllGCPCommands function to execute all child commands
+var GCPAllChecksCommand = &cobra.Command{
+	Use:   "all-checks",
+	Short: "Runs all available GCP commands",
+	Long:  `Executes all available GCP commands to collect and display information from all supported GCP services.`,
+	Run: func(cmd *cobra.Command, args []string) {
+		for _, childCmd := range GCPCommands.Commands() {
+			if childCmd == cmd { // Skip the run-all command itself to avoid infinite recursion
+				continue
+			}
+
+			GCPLogger.InfoM(fmt.Sprintf("Running command: %s", childCmd.Use), "all-checks")
+			childCmd.Run(cmd, args)
+		}
+	},
+}
+
+func init() {
+	// Globals flags for the GCP commands
+
+	// Allow selection of non-default account to be used when accessing gcloud API
+	// TODO
+
+	// Resource filtering options
+	// GCPCommands.PersistentFlags().StringVarP(&GCPOrganization, "organization", "o", "", "Organization name or number, repetable")
+	GCPCommands.PersistentFlags().StringVarP(&GCPProjectID, "project", "p", "", "GCP project ID")
+	GCPCommands.PersistentFlags().StringVarP(&GCPProjectIDsFilePath, "project-list", "l", "", "Path to a file containing a list of project IDs separated by newlines")
+	// GCPCommands.PersistentFlags().BoolVarP(&GCPAllProjects, "all-projects", "a", false, "Use all project IDs available to activated gloud account or given gcloud account")
+	// GCPCommands.PersistentFlags().BoolVarP(&GCPConfirm, "yes", "y", false, "Non-interactive mode (like apt/yum)")
+	// GCPCommands.PersistentFlags().StringVarP(&GCPOutputFormat, "output", "", "brief", "[\"brief\" | \"wide\" ]")
+	GCPCommands.PersistentFlags().IntVarP(&Verbosity, "verbosity", "v", 1, "1 = Print control messages only\n2 = Print control messages, module output\n3 = Print control messages, module output, and loot file output\n")
+	// defaultOutputDir is defined in cli.aws
+	GCPCommands.PersistentFlags().StringVar(&GCPOutputDirectory, "outdir", defaultOutputDir, "Output Directory ")
+	// GCPCommands.PersistentFlags().IntVarP(&Goroutines, "max-goroutines", "g", 30, "Maximum number of concurrent goroutines")
+	GCPCommands.PersistentFlags().BoolVarP(&GCPWrapTable, "wrap", "w", false, "Wrap table to fit in terminal (complicates grepping)")
+
+	// Available commands
+	GCPCommands.AddCommand(
+		commands.GCPBucketsCommand,
+		commands.GCPArtifactRegistryCommand,
+		commands.GCPBigQueryCommand,
+		commands.GCPSecretsCommand,
+		commands.GCPIAMCommand,
+		commands.GCPInstancesCommand,
+		commands.GCPWhoAmICommand,
+		GCPAllChecksCommand,
+	)
+}

gcp/commands/artifact-registry.go

@@ -0,0 +1,172 @@
+package commands
+
+import (
+	"fmt"
+
+	artifactregistry "cloud.google.com/go/artifactregistry/apiv1"
+	ArtifactRegistryService "github.com/BishopFox/cloudfox/gcp/services/artifactRegistryService"
+	"github.com/BishopFox/cloudfox/globals"
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/spf13/cobra"
+)
+
+var GCPArtifactRegistryCommand = &cobra.Command{
+	Use:     globals.GCP_ARTIFACT_RESGISTRY_MODULE_NAME,
+	Aliases: []string{},
+	Short:   "Display GCP artifact registry information",
+	Args:    cobra.MinimumNArgs(0),
+	Long: `
+Display available artifact registry resource information:
+cloudfox gcp artfact-registry`,
+	Run: runGCPArtifactRegistryCommand,
+}
+
+// Code needed to output fields from buckets results using generic HandleOutput function
+
+// Results struct that implements the internal.OutputInterface
+type GCPArtifactRegistryResults struct {
+	ArtifactData   []ArtifactRegistryService.ArtifactInfo
+	RepositoryData []ArtifactRegistryService.RepositoryInfo
+}
+
+// Decide what format the name, header and body of the CSV & JSON files will be
+func (g GCPArtifactRegistryResults) TableFiles() []internal.TableFile {
+	var tableFiles []internal.TableFile
+
+	repoHeader := []string{
+		"Name",
+		"Format",
+		"Description",
+		"Size",
+		"Location",
+		"ProjectID",
+	}
+
+	var repoBody [][]string
+
+	for _, value := range g.RepositoryData {
+		repoBody = append(
+			repoBody,
+			[]string{
+				value.Name,
+				value.Format,
+				value.Description,
+				value.SizeBytes,
+				value.Location,
+				value.ProjectID,
+			},
+		)
+	}
+
+	repoTableFile := internal.TableFile{
+		Header: repoHeader,
+		Body:   repoBody,
+		Name:   fmt.Sprintf("%s-repos", globals.GCP_ARTIFACT_RESGISTRY_MODULE_NAME),
+	}
+
+	tableFiles = append(tableFiles, repoTableFile)
+
+	artifactHeader := []string{
+		"Name",
+		"Format",
+		"Version",
+		"Location",
+		"Repository",
+		"Size",
+		"Updated",
+		"ProjectID",
+	}
+
+	var artifactBody [][]string
+
+	for _, value := range g.ArtifactData {
+		artifactBody = append(
+			artifactBody,
+			[]string{
+				value.Name,
+				value.Format,
+				value.Version,
+				value.Location,
+				value.Repository,
+				value.SizeBytes,
+				value.Updated,
+				value.ProjectID,
+			},
+		)
+	}
+
+	artifactTableFile := internal.TableFile{
+		Header: artifactHeader,
+		Body:   artifactBody,
+		Name:   fmt.Sprintf("%s-artifacts", globals.GCP_ARTIFACT_RESGISTRY_MODULE_NAME),
+	}
+
+	tableFiles = append(tableFiles, artifactTableFile)
+
+	return tableFiles
+}
+
+// Decide what is loot based on resource information
+func (g GCPArtifactRegistryResults) LootFiles() []internal.LootFile {
+	// TODO consider a loot file of the URLs to the all docker image artifacts. Maybe sample commands to pull the images
+	return []internal.LootFile{}
+}
+
+// Houses high-level logic that retrieves resources and writes to output
+func runGCPArtifactRegistryCommand(cmd *cobra.Command, args []string) {
+	// Retrieve projectIDs from parent (gcp command) ctx
+	var projectIDs []string
+	var account string
+	parentCmd := cmd.Parent()
+	ctx := cmd.Context()
+	logger := internal.NewLogger()
+	if value, ok := ctx.Value("projectIDs").([]string); ok && len(value) > 0 {
+		projectIDs = value
+	} else {
+		logger.ErrorM("Could not retrieve projectIDs from flag value or value is empty", globals.GCP_ARTIFACT_RESGISTRY_MODULE_NAME)
+	}
+
+	if value, ok := ctx.Value("account").(string); ok {
+		account = value
+	} else {
+		logger.ErrorM("Could not retrieve account email from command", globals.GCP_ARTIFACT_RESGISTRY_MODULE_NAME)
+	}
+
+	client, err := artifactregistry.NewClient(ctx)
+	if err != nil {
+		logger.ErrorM(fmt.Sprintf("failed to create secret manager client: %v", err), globals.GCP_SECRETS_MODULE_NAME)
+		return
+	}
+	defer client.Close()
+
+	// Get the artifact repositories and artifacts using the projectIDs and ArtifactRegistryService
+	ars := ArtifactRegistryService.New(client)
+	var artifactResults []ArtifactRegistryService.ArtifactInfo
+	var repoRestuls []ArtifactRegistryService.RepositoryInfo
+
+	// Set output params leveraging parent (gcp) pflag values
+	verbosity, _ := parentCmd.PersistentFlags().GetInt("verbosity")
+	wrap, _ := parentCmd.PersistentFlags().GetBool("wrap")
+	outputDirectory, _ := parentCmd.PersistentFlags().GetString("outdir")
+	format, _ := parentCmd.PersistentFlags().GetString("output")
+	for _, projectID := range projectIDs {
+		logger.InfoM(fmt.Sprintf("Retrieving all artifact repositories and supported artifacts in all locations from project: %s", projectID), globals.GCP_ARTIFACT_RESGISTRY_MODULE_NAME)
+		result, err := ars.RepositoriesAndArtifacts(projectID)
+		if err != nil {
+			logger.ErrorM(err.Error(), globals.GCP_ARTIFACT_RESGISTRY_MODULE_NAME)
+			return
+		}
+
+		artifactResults = append(artifactResults, result.Artifacts...)
+		repoRestuls = append(repoRestuls, result.Repositories...)
+		logger.InfoM(fmt.Sprintf("Done retrieving artifact repository resource data from project: %s", projectID), globals.GCP_ARTIFACT_RESGISTRY_MODULE_NAME)
+		cloudfoxOutput := GCPArtifactRegistryResults{ArtifactData: artifactResults, RepositoryData: repoRestuls}
+
+		err = internal.HandleOutput("gcp", format, outputDirectory, verbosity, wrap, globals.GCP_ARTIFACT_RESGISTRY_MODULE_NAME, account, projectID, cloudfoxOutput)
+		if err != nil {
+			logger.ErrorM(err.Error(), globals.GCP_ARTIFACT_RESGISTRY_MODULE_NAME)
+			return
+		}
+		logger.InfoM(fmt.Sprintf("Done writing output for project %s", projectID), globals.GCP_ARTIFACT_RESGISTRY_MODULE_NAME)
+	}
+}

gcp/commands/bigquery.go

@@ -0,0 +1,134 @@
+package commands
+
+import (
+	"fmt"
+	"time"
+
+	BigQueryService "github.com/BishopFox/cloudfox/gcp/services/bigqueryService"
+	"github.com/BishopFox/cloudfox/globals"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/spf13/cobra"
+)
+
+var GCPBigQueryCommand = &cobra.Command{
+	Use:     "bigquery",
+	Aliases: []string{},
+	Short:   "Display Bigauery datasets and tables information",
+	Args:    cobra.MinimumNArgs(0),
+	Long: `
+Display available Bigauery datasets and tables resource information:
+cloudfox gcp bigquery`,
+	Run: runGCPBigQueryCommand,
+}
+
+// GCPBigQueryResults struct that implements the internal.OutputInterface
+type GCPBigQueryResults struct {
+	DatasetsData []BigQueryService.BigqueryDataset
+	TablesData   []BigQueryService.BigqueryTable
+}
+
+// Define the format for CSV & JSON output
+func (g GCPBigQueryResults) TableFiles() []internal.TableFile {
+	var tableFiles []internal.TableFile
+
+	// For Datasets
+	datasetHeader := []string{"Name", "DatasetID", "Description", "CreationTime", "LastModifiedTime", "Location", "ProjectID"}
+	var datasetBody [][]string
+	for _, dataset := range g.DatasetsData {
+		datasetBody = append(datasetBody, []string{
+			dataset.Name,
+			dataset.DatasetID,
+			dataset.Description,
+			dataset.CreationTime.Format(time.RFC3339),
+			dataset.LastModifiedTime.Format(time.RFC3339),
+			dataset.Location,
+			dataset.ProjectID,
+		})
+	}
+	datasetTableFile := internal.TableFile{
+		Header: datasetHeader,
+		Body:   datasetBody,
+		Name:   "bigquery-datasets",
+	}
+	tableFiles = append(tableFiles, datasetTableFile)
+
+	// For Tables
+	tableHeader := []string{"TableID", "DatasetID", "Description", "CreationTime", "LastModifiedTime", "NumBytes", "Location", "ProjectID"}
+	var tableBody [][]string
+	for _, table := range g.TablesData {
+		tableBody = append(tableBody, []string{
+			table.TableID,
+			table.DatasetID,
+			table.Description,
+			table.CreationTime.Format(time.RFC3339),
+			table.LastModifiedTime.Format(time.RFC3339),
+			fmt.Sprintf("%d", table.NumBytes),
+			table.Location,
+			table.ProjectID,
+		})
+	}
+	tableTableFile := internal.TableFile{
+		Header: tableHeader,
+		Body:   tableBody,
+		Name:   "bigquery-tables",
+	}
+	tableFiles = append(tableFiles, tableTableFile)
+
+	return tableFiles
+}
+
+func (g GCPBigQueryResults) LootFiles() []internal.LootFile {
+	// Implement if there's specific data considered as loot
+	return []internal.LootFile{}
+}
+
+func runGCPBigQueryCommand(cmd *cobra.Command, args []string) {
+	var projectIDs []string
+	var account string
+	parentCmd := cmd.Parent()
+	ctx := cmd.Context()
+	logger := internal.NewLogger()
+	if value, ok := ctx.Value("projectIDs").([]string); ok && len(value) > 0 {
+		projectIDs = value
+	} else {
+		logger.ErrorM("Could not retrieve projectIDs from flag value or value is empty", globals.GCP_BIGQUERY_MODULE_NAME)
+		return
+	}
+
+	if value, ok := ctx.Value("account").(string); ok {
+		account = value
+	} else {
+		logger.ErrorM("Could not retrieve account email from command", globals.GCP_BIGQUERY_MODULE_NAME)
+	}
+
+	bqService := BigQueryService.New()
+	var datasetsResults []BigQueryService.BigqueryDataset
+	var tablesResults []BigQueryService.BigqueryTable
+
+	// Set output params leveraging parent (gcp) pflag values
+	verbosity, _ := parentCmd.PersistentFlags().GetInt("verbosity")
+	wrap, _ := parentCmd.PersistentFlags().GetBool("wrap")
+	outputDirectory, _ := parentCmd.PersistentFlags().GetString("outdir")
+	format, _ := parentCmd.PersistentFlags().GetString("output")
+
+	for _, projectID := range projectIDs {
+		logger.InfoM(fmt.Sprintf("Retrieving BigQuery datasets and tables from project: %s", projectID), globals.GCP_BIGQUERY_MODULE_NAME)
+		result, err := bqService.BigqueryDatasetsAndTables(projectID)
+		if err != nil {
+			logger.ErrorM(err.Error(), globals.GCP_BIGQUERY_MODULE_NAME)
+			return
+		}
+
+		datasetsResults = append(datasetsResults, result.Datasets...)
+		tablesResults = append(tablesResults, result.Tables...)
+		cloudfoxOutput := GCPBigQueryResults{DatasetsData: datasetsResults, TablesData: tablesResults}
+
+		err = internal.HandleOutput("gcp", format, outputDirectory, verbosity, wrap, globals.GCP_BIGQUERY_MODULE_NAME, account, projectID, cloudfoxOutput)
+		if err != nil {
+			logger.ErrorM(err.Error(), globals.GCP_BIGQUERY_MODULE_NAME)
+			return
+		}
+		logger.InfoM(fmt.Sprintf("Done writing output for project %s", projectID), globals.GCP_BIGQUERY_MODULE_NAME)
+	}
+}

gcp/commands/buckets.go

@@ -0,0 +1,115 @@
+package commands
+
+import (
+	"fmt"
+
+	CloudStorageService "github.com/BishopFox/cloudfox/gcp/services/cloudStorageService"
+	"github.com/BishopFox/cloudfox/globals"
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/spf13/cobra"
+)
+
+var GCPBucketsCommand = &cobra.Command{
+	Use:     globals.GCP_BUCKETS_MODULE_NAME,
+	Aliases: []string{},
+	Short:   "Display GCP buckets information",
+	Args:    cobra.MinimumNArgs(0),
+	Long: `
+Display available bucket information:
+cloudfox gcp buckets`,
+	Run: runGCPBucketsCommand,
+}
+
+// Code needed to output fields from buckets results using generic HandleOutput function
+
+// Results struct that implements the internal.OutputInterface
+type GCPBucketsResults struct {
+	Data []CloudStorageService.BucketInfo
+}
+
+// Decide what format the name, header and body of the CSV & JSON files will be
+func (g GCPBucketsResults) TableFiles() []internal.TableFile {
+	var tableFiles []internal.TableFile
+
+	header := []string{
+		"Name",
+		"Location",
+		"ProjectID",
+	}
+
+	var body [][]string
+
+	for _, value := range g.Data {
+		body = append(
+			body,
+			[]string{
+				value.Name,
+				value.Location,
+				value.ProjectID,
+			},
+		)
+	}
+
+	tableFile := internal.TableFile{
+		Header: header,
+		Body:   body,
+		Name:   globals.GCP_BUCKETS_MODULE_NAME,
+	}
+	tableFiles = append(tableFiles, tableFile)
+
+	return tableFiles
+}
+
+// Decide what is loot based on resource information
+func (g GCPBucketsResults) LootFiles() []internal.LootFile {
+	return []internal.LootFile{}
+}
+
+// Houses high-level logic that retrieves resources and writes to output
+func runGCPBucketsCommand(cmd *cobra.Command, args []string) {
+	// Retrieve projectIDs from parent (gcp command) ctx
+	var projectIDs []string
+	var account string
+	parentCmd := cmd.Parent()
+	ctx := cmd.Context()
+	logger := internal.NewLogger()
+	if value, ok := ctx.Value("projectIDs").([]string); ok && len(value) > 0 {
+		projectIDs = value
+	} else {
+		logger.ErrorM("Could not retrieve projectIDs from flag value or value is empty", globals.GCP_BUCKETS_MODULE_NAME)
+	}
+
+	if value, ok := ctx.Value("account").(string); ok {
+		account = value
+	} else {
+		logger.ErrorM("Could not retrieve account email from command", globals.GCP_BUCKETS_MODULE_NAME)
+	}
+
+	// Get the bucket info using the projectIDs and CloudStorageService
+	cs := CloudStorageService.New()
+	var results []CloudStorageService.BucketInfo
+
+	// Set output params leveraging parent (gcp) pflag values
+	verbosity, _ := parentCmd.PersistentFlags().GetInt("verbosity")
+	wrap, _ := parentCmd.PersistentFlags().GetBool("wrap")
+	outputDirectory, _ := parentCmd.PersistentFlags().GetString("outdir")
+	format, _ := parentCmd.PersistentFlags().GetString("output")
+
+	for _, projectID := range projectIDs {
+		logger.InfoM(fmt.Sprintf("Retrieving all buckets from project: %s", projectID), globals.GCP_BUCKETS_MODULE_NAME)
+		result, err := cs.Buckets(projectID)
+		if err != nil {
+			logger.ErrorM(err.Error(), globals.GCP_BUCKETS_MODULE_NAME)
+			return
+		}
+		results = append(results, result...)
+		logger.InfoM(fmt.Sprintf("Done retrieving all buckets from project: %s", projectID), globals.GCP_BUCKETS_MODULE_NAME)
+		cloudfoxOutput := GCPBucketsResults{Data: results}
+		err = internal.HandleOutput("gcp", format, outputDirectory, verbosity, wrap, globals.GCP_BUCKETS_MODULE_NAME, account, projectID, cloudfoxOutput)
+		if err != nil {
+			logger.ErrorM(err.Error(), globals.GCP_BUCKETS_MODULE_NAME)
+			return
+		}
+		logger.InfoM(fmt.Sprintf("Done writing output for project %s", projectID), globals.GCP_BUCKETS_MODULE_NAME)
+	}
+}

gcp/commands/iam.go

@@ -0,0 +1,122 @@
+package commands
+
+import (
+	"fmt"
+
+	IAMService "github.com/BishopFox/cloudfox/gcp/services/iamService"
+	"github.com/BishopFox/cloudfox/globals"
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/spf13/cobra"
+)
+
+var GCPIAMCommand = &cobra.Command{
+	Use:     globals.GCP_IAM_MODULE_NAME,
+	Aliases: []string{},
+	Short:   "Display GCP IAM information",
+	Args:    cobra.MinimumNArgs(0),
+	Long: `
+Display IAM principals and their roles information within GCP resources:
+cloudfox gcp iam`,
+	Run: runGCPIAMCommand,
+}
+
+// Results struct for IAM command that implements the internal.OutputInterface
+type GCPIAMResults struct {
+	Data []IAMService.PrincipalWithRoles
+}
+
+// TableFiles formats the data for table output, CSV & JSON files
+func (g GCPIAMResults) TableFiles() []internal.TableFile {
+	var tableFiles []internal.TableFile
+
+	header := []string{
+		"Name",
+		"Principal Type",
+		"Role",
+		"PolicyResourceType",
+		"PolicyResourceID",
+	}
+
+	var body [][]string
+
+	for _, principal := range g.Data {
+		for _, binding := range principal.PolicyBindings {
+			body = append(body, []string{
+				principal.Name,
+				principal.Type,
+				binding.Role,
+				principal.ResourceType,
+				principal.ResourceID,
+			})
+		}
+	}
+
+	tableFile := internal.TableFile{
+		Header: header,
+		Body:   body,
+		Name:   globals.GCP_IAM_MODULE_NAME,
+	}
+	tableFiles = append(tableFiles, tableFile)
+
+	return tableFiles
+}
+
+// LootFiles can be implemented if needed
+func (g GCPIAMResults) LootFiles() []internal.LootFile {
+	return []internal.LootFile{}
+}
+
+// Houses high-level logic that retrieves IAM information and writes to output
+func runGCPIAMCommand(cmd *cobra.Command, args []string) {
+	// Retrieve projectIDs and resource type from parent (gcp command) ctx
+	var projectIDs []string
+	var resourceType string
+	var account string
+	parentCmd := cmd.Parent()
+	ctx := cmd.Context()
+	logger := internal.NewLogger()
+	if value, ok := ctx.Value("projectIDs").([]string); ok && len(value) > 0 {
+		projectIDs = value
+	} else {
+		logger.ErrorM("Could not retrieve projectIDs from flag value or value is empty", globals.GCP_IAM_MODULE_NAME)
+		return
+	}
+
+	if value, ok := ctx.Value("account").(string); ok {
+		account = value
+	} else {
+		logger.ErrorM("Could not retrieve account email from command", globals.GCP_IAM_MODULE_NAME)
+	}
+
+	// TODO fix once folders or organizations are supported as input for project root
+	resourceType = "project"
+
+	// Initialize IAMService and fetch principals with roles for the given projectIDs and resource type
+	iamService := IAMService.New()
+	var results []IAMService.PrincipalWithRoles
+
+	// Set output params leveraging parent (gcp) pflag values
+	verbosity, _ := parentCmd.PersistentFlags().GetInt("verbosity")
+	wrap, _ := parentCmd.PersistentFlags().GetBool("wrap")
+	outputDirectory, _ := parentCmd.PersistentFlags().GetString("outdir")
+	format, _ := parentCmd.PersistentFlags().GetString("output")
+
+	for _, projectID := range projectIDs {
+		logger.InfoM(fmt.Sprintf("Retrieving IAM information for resource: %s of type %s", projectID, resourceType), globals.GCP_IAM_MODULE_NAME)
+		principals, err := iamService.PrincipalsWithRoles(projectID, resourceType)
+		if err != nil {
+			logger.ErrorM(err.Error(), globals.GCP_IAM_MODULE_NAME)
+			return
+		}
+		results = append(results, principals...)
+		logger.InfoM(fmt.Sprintf("Done retrieving IAM information for resource: %s of type %s", projectID, resourceType), globals.GCP_IAM_MODULE_NAME)
+		cloudfoxOutput := GCPIAMResults{Data: results}
+
+		err = internal.HandleOutput("gcp", format, outputDirectory, verbosity, wrap, globals.GCP_IAM_MODULE_NAME, account, projectID, cloudfoxOutput)
+		if err != nil {
+			logger.ErrorM(err.Error(), globals.GCP_IAM_MODULE_NAME)
+			return
+		}
+		logger.InfoM(fmt.Sprintf("Done writing output for project %s", projectID), globals.GCP_IAM_MODULE_NAME)
+	}
+}

gcp/commands/instances.go

@@ -0,0 +1,126 @@
+package commands
+
+import (
+	"fmt"
+
+	ComputeEngineService "github.com/BishopFox/cloudfox/gcp/services/computeEngineService"
+	"github.com/BishopFox/cloudfox/globals"
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/spf13/cobra"
+)
+
+var GCPInstancesCommand = &cobra.Command{
+	Use:     globals.GCP_INSTANCES_MODULE_NAME, // This should be defined in the globals package
+	Aliases: []string{},
+	Short:   "Display GCP Compute Engine instances information",
+	Args:    cobra.MinimumNArgs(0),
+	Long: `
+Display available Compute Engine instances information:
+cloudfox gcp instances`,
+	Run: runGCPInstancesCommand,
+}
+
+// GCPInstancesResults implements internal.OutputInterface for Compute Engine instances
+type GCPInstancesResults struct {
+	Data []ComputeEngineService.ComputeEngineInfo
+}
+
+func (g GCPInstancesResults) TableFiles() []internal.TableFile {
+	var tableFiles []internal.TableFile
+
+	header := []string{
+		"Name",
+		"ID",
+		"State",
+		"ExternalIP",
+		"InternalIP",
+		"ServiceAccount", // Adding ServiceAccount to the header
+		"Zone",
+		"ProjectID",
+	}
+
+	var body [][]string
+	for _, instance := range g.Data {
+		// Initialize an empty string to aggregate service account emails
+		var serviceAccountEmails string
+		for _, serviceAccount := range instance.ServiceAccounts {
+			// Assuming each instance can have multiple service accounts, concatenate their emails
+			if serviceAccountEmails != "" {
+				serviceAccountEmails += "; " // Use semicolon as a delimiter for multiple emails
+			}
+			serviceAccountEmails += serviceAccount.Email
+		}
+
+		body = append(body, []string{
+			instance.Name,
+			instance.ID,
+			instance.State,
+			instance.ExternalIP,
+			instance.InternalIP,
+			serviceAccountEmails, // Add the aggregated service account emails to the output
+			instance.Zone,
+			instance.ProjectID,
+		})
+	}
+
+	tableFiles = append(tableFiles, internal.TableFile{
+		Name:   globals.GCP_INSTANCES_MODULE_NAME,
+		Header: header,
+		Body:   body,
+	})
+
+	return tableFiles
+}
+
+func (g GCPInstancesResults) LootFiles() []internal.LootFile {
+	// Define any loot files if applicable
+	return []internal.LootFile{}
+}
+
+func runGCPInstancesCommand(cmd *cobra.Command, args []string) {
+	var projectIDs []string
+	var account string
+	parentCmd := cmd.Parent()
+	ctx := cmd.Context()
+	logger := internal.NewLogger()
+
+	if value, ok := ctx.Value("projectIDs").([]string); ok && len(value) > 0 {
+		projectIDs = value
+	} else {
+		logger.ErrorM("Could not retrieve projectIDs from flag value or value is empty", globals.GCP_INSTANCES_MODULE_NAME)
+		return
+	}
+
+	if value, ok := ctx.Value("account").(string); ok {
+		account = value
+	} else {
+		logger.ErrorM("Could not retrieve account email from command", globals.GCP_IAM_MODULE_NAME)
+	}
+
+	ces := ComputeEngineService.New()
+	var results []ComputeEngineService.ComputeEngineInfo
+
+	// Set output params leveraging parent (gcp) pflag values
+	verbosity, _ := parentCmd.PersistentFlags().GetInt("verbosity")
+	wrap, _ := parentCmd.PersistentFlags().GetBool("wrap")
+	outputDirectory, _ := parentCmd.PersistentFlags().GetString("outdir")
+	format, _ := parentCmd.PersistentFlags().GetString("output")
+
+	for _, projectID := range projectIDs {
+		logger.InfoM(fmt.Sprintf("Retrieving all instances from project: %s", projectID), globals.GCP_INSTANCES_MODULE_NAME)
+		result, err := ces.Instances(projectID)
+		if err != nil {
+			logger.ErrorM(err.Error(), globals.GCP_INSTANCES_MODULE_NAME)
+			return
+		}
+		results = append(results, result...)
+		logger.InfoM(fmt.Sprintf("Done retrieving all instances from project: %s", projectID), globals.GCP_INSTANCES_MODULE_NAME)
+		cloudfoxOutput := GCPInstancesResults{Data: results}
+		err = internal.HandleOutput("gcp", format, outputDirectory, verbosity, wrap, globals.GCP_INSTANCES_MODULE_NAME, account, projectID, cloudfoxOutput)
+		if err != nil {
+			logger.ErrorM(err.Error(), globals.GCP_INSTANCES_MODULE_NAME)
+			return
+		}
+		logger.InfoM("Done writing output", globals.GCP_INSTANCES_MODULE_NAME)
+	}
+}

gcp/commands/secrets.go

@@ -0,0 +1,120 @@
+package commands
+
+import (
+	"fmt"
+
+	secretmanager "cloud.google.com/go/secretmanager/apiv1"
+	SecretsService "github.com/BishopFox/cloudfox/gcp/services/secretsService"
+	"github.com/BishopFox/cloudfox/globals"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/spf13/cobra"
+)
+
+var GCPSecretsCommand = &cobra.Command{
+	Use:     globals.GCP_SECRETS_MODULE_NAME,
+	Aliases: []string{},
+	Short:   "Display GCP secrets information",
+	Args:    cobra.MinimumNArgs(0),
+	Long: `
+Display available secrets information:
+cloudfox gcp secrets`,
+	Run: runGCPSecretsCommand,
+}
+
+// GCPSecretsResults struct that implements the internal.OutputInterface
+type GCPSecretsResults struct {
+	Data []SecretsService.SecretInfo
+}
+
+func (g GCPSecretsResults) TableFiles() []internal.TableFile {
+	var tableFiles []internal.TableFile
+
+	header := []string{
+		"Name",
+		"CreationTime",
+		"Labels",
+		"Rotation",
+		"ProjectID",
+		// Add more fields as necessary
+	}
+
+	var body [][]string
+	for _, value := range g.Data {
+		body = append(body, []string{
+			value.Name,
+			value.CreationTime,
+			fmt.Sprintf("%v", value.Labels),
+			value.Rotation,
+			value.ProjectID,
+		})
+	}
+
+	tableFile := internal.TableFile{
+		Header: header,
+		Body:   body,
+		Name:   globals.GCP_SECRETS_MODULE_NAME,
+	}
+	tableFiles = append(tableFiles, tableFile)
+
+	return tableFiles
+}
+
+func (g GCPSecretsResults) LootFiles() []internal.LootFile {
+	// Define any specific data considered as loot
+	return []internal.LootFile{}
+}
+
+func runGCPSecretsCommand(cmd *cobra.Command, args []string) {
+	var projectIDs []string
+	var account string
+	parentCmd := cmd.Parent()
+	ctx := cmd.Context()
+	logger := internal.NewLogger()
+	if value, ok := ctx.Value("projectIDs").([]string); ok && len(value) > 0 {
+		projectIDs = value
+	} else {
+		logger.ErrorM("Could not retrieve projectIDs from flag value or value is empty", globals.GCP_SECRETS_MODULE_NAME)
+		return
+	}
+
+	if value, ok := ctx.Value("account").(string); ok {
+		account = value
+	} else {
+		logger.ErrorM("Could not retrieve account email from command", globals.GCP_IAM_MODULE_NAME)
+	}
+
+	client, err := secretmanager.NewClient(ctx)
+	if err != nil {
+		logger.ErrorM(fmt.Sprintf("failed to create secret manager client: %v", err), globals.GCP_SECRETS_MODULE_NAME)
+		return
+	}
+	defer client.Close()
+
+	ss := SecretsService.New(client)
+	var results []SecretsService.SecretInfo
+
+	// Set output params from parentCmd
+	verbosity, _ := parentCmd.PersistentFlags().GetInt("verbosity")
+	wrap, _ := parentCmd.PersistentFlags().GetBool("wrap")
+	outputDirectory, _ := parentCmd.PersistentFlags().GetString("outdir")
+	format, _ := parentCmd.PersistentFlags().GetString("output")
+
+	for _, projectID := range projectIDs {
+		logger.InfoM(fmt.Sprintf("Retrieving all secrets from project: %s", projectID), globals.GCP_SECRETS_MODULE_NAME)
+		result, err := ss.Secrets(projectID)
+		if err != nil {
+			logger.ErrorM(err.Error(), globals.GCP_SECRETS_MODULE_NAME)
+			return
+		}
+		results = append(results, result...)
+		logger.InfoM(fmt.Sprintf("Done retrieving all secrets from project: %s", projectID), globals.GCP_SECRETS_MODULE_NAME)
+		cloudfoxOutput := GCPSecretsResults{Data: results}
+		err = internal.HandleOutput("gcp", format, outputDirectory, verbosity, wrap, globals.GCP_SECRETS_MODULE_NAME, account, projectID, cloudfoxOutput)
+		if err != nil {
+			logger.ErrorM(err.Error(), globals.GCP_SECRETS_MODULE_NAME)
+			return
+		}
+		logger.InfoM(fmt.Sprintf("Done writing output for project %s", projectID), globals.GCP_SECRETS_MODULE_NAME)
+	}
+}

gcp/commands/whoami.go

@@ -0,0 +1,34 @@
+package commands
+
+import (
+	"fmt"
+
+	OAuthService "github.com/BishopFox/cloudfox/gcp/services/oauthService"
+	"github.com/BishopFox/cloudfox/globals"
+
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/spf13/cobra"
+)
+
+var GCPWhoAmICommand = &cobra.Command{
+	Use:   globals.GCP_WHOAMI_MODULE_NAME,
+	Short: "Display the email address of the GCP authenticated user",
+	Args:  cobra.NoArgs,
+	Run:   runGCPWhoAmICommand,
+}
+
+func runGCPWhoAmICommand(cmd *cobra.Command, args []string) {
+	logger := internal.NewLogger()
+
+	// Initialize the OAuthService
+	oauthService := OAuthService.NewOAuthService()
+
+	// Call the WhoAmI function
+	principal, err := oauthService.WhoAmI()
+	if err != nil {
+		logger.ErrorM(fmt.Sprintf("Error retrieving token info: %v", err), globals.GCP_WHOAMI_MODULE_NAME)
+		return
+	}
+
+	logger.InfoM(fmt.Sprintf("authenticated user email: %s", principal.Email), globals.GCP_WHOAMI_MODULE_NAME)
+}

gcp/services/artifactRegistryService/artifactRegistryService.go

@@ -0,0 +1,236 @@
+package artifactregistryservice
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	artifactregistry "cloud.google.com/go/artifactregistry/apiv1"
+	artifactregistrypb "cloud.google.com/go/artifactregistry/apiv1/artifactregistrypb"
+	"github.com/BishopFox/cloudfox/gcp/services/models"
+	"github.com/BishopFox/cloudfox/globals"
+	"github.com/BishopFox/cloudfox/internal"
+	"github.com/googleapis/gax-go/v2"
+	"google.golang.org/api/iterator"
+	locationpb "google.golang.org/genproto/googleapis/cloud/location"
+)
+
+// New creates a new instance of the ArtifactRegistryService using an artifactregistry.Client
+func New(client *artifactregistry.Client) ArtifactRegistryService {
+	ars := ArtifactRegistryService{
+		Client: &ArtifactRegistryClientWrapper{
+			Closer: client.Close,
+			RepositoryLister: func(ctx context.Context, req *artifactregistrypb.ListRepositoriesRequest, opts ...gax.CallOption) models.GenericIterator[artifactregistrypb.Repository] {
+				return client.ListRepositories(ctx, req, opts...)
+			},
+			LocationLister: func(ctx context.Context, req *locationpb.ListLocationsRequest, opts ...gax.CallOption) models.GenericIterator[locationpb.Location] {
+				return client.ListLocations(ctx, req, opts...)
+			},
+			RepositoryGetter: func(ctx context.Context, req *artifactregistrypb.GetRepositoryRequest, opts ...gax.CallOption) (*artifactregistrypb.Repository, error) {
+				return client.GetRepository(ctx, req, opts...)
+			},
+			DockerImageLister: func(ctx context.Context, req *artifactregistrypb.ListDockerImagesRequest, opts ...gax.CallOption) models.GenericIterator[artifactregistrypb.DockerImage] {
+				return client.ListDockerImages(ctx, req, opts...)
+			},
+		},
+	}
+	return ars
+}
+
+var logger internal.Logger
+
+// RepositoriesAndArtifacts retrieves both repositories and their artifacts for a given projectID.
+func (ars *ArtifactRegistryService) RepositoriesAndArtifacts(projectID string) (CombinedRepoArtifactInfo, error) {
+	var combinedInfo CombinedRepoArtifactInfo
+
+	// Retrieve repositories.
+	repos, err := ars.Repositories(projectID)
+	if err != nil {
+		return combinedInfo, fmt.Errorf("failed to retrieve repositories: %v", err)
+	}
+	combinedInfo.Repositories = repos
+
+	// Iterate over repositories to fetch artifacts.
+	for _, repo := range repos {
+		// Extract location and repository name from the repository Name.
+		parts := strings.Split(repo.Name, "/")
+		if len(parts) < 6 {
+			logger.InfoM("Unexpected repository name format, skipping artifacts retrieval", globals.GCP_ARTIFACT_RESGISTRY_MODULE_NAME)
+			continue
+		}
+		location := parts[3]
+		repositoryName := parts[5]
+
+		// Fetch artifacts for the current repository.
+		artifacts, err := ars.Artifacts(projectID, location, repositoryName)
+		if err != nil {
+			logger.InfoM(fmt.Sprintf("Failed to retrieve artifacts for repository %s: %v", repositoryName, err), globals.GCP_ARTIFACT_RESGISTRY_MODULE_NAME)
+			continue // Optionally continue to the next repository or handle error differently.
+		}
+		combinedInfo.Artifacts = append(combinedInfo.Artifacts, artifacts...)
+	}
+
+	return combinedInfo, nil
+}
+
+// RepositoriesAndArtifacts returns a list of repositories and artifacts given projectID.
+// TODO consider putting location as input, so that we can put Locations iteration before it & potentially filter by location at top level of GCP module
+func (ars *ArtifactRegistryService) Repositories(projectID string) ([]RepositoryInfo, error) {
+	// Get the list of available locations for the given project.
+	locations, err := ars.projectLocations(projectID)
+	if err != nil {
+		return nil, err
+	}
+
+	var repositories []RepositoryInfo
+	ctx := context.Background()
+	// Construct the request for listing repositories.
+	for _, location := range locations {
+		req := &artifactregistrypb.ListRepositoriesRequest{
+			Parent: fmt.Sprintf("projects/%s/locations/%s", projectID, location),
+		}
+
+		it := ars.Client.ListRepositories(ctx, req)
+		for {
+			repo, err := it.Next()
+			if err == iterator.Done {
+				break
+			}
+			if err != nil {
+				return nil, err
+			}
+
+			repositories = append(repositories, RepositoryInfo{
+				Name:        repo.Name,
+				Format:      repo.Format.String(),
+				Description: repo.Description,
+				SizeBytes:   fmt.Sprintf("%d", repo.SizeBytes),
+				ProjectID:   projectID,
+				Location:    location,
+			})
+		}
+	}
+
+	return repositories, nil
+}
+
+// Artifacts fetches the artifacts for a given repository, handling different formats.
+func (ars *ArtifactRegistryService) Artifacts(projectID string, location string, repositoryName string) ([]ArtifactInfo, error) {
+	ctx := context.Background()
+	// client, err := artifactregistry.NewClient(ctx)
+	// if err != nil {
+	// 	return nil, fmt.Errorf("failed to create artifact registry client: %v", err)
+	// }
+	// defer client.Close()
+
+	repoFullName := fmt.Sprintf("projects/%s/locations/%s/repositories/%s", projectID, location, repositoryName)
+
+	// Fetch repository details to determine its format
+	repo, err := ars.Client.GetRepository(ctx, &artifactregistrypb.GetRepositoryRequest{Name: repoFullName})
+	if err != nil {
+		return nil, fmt.Errorf("failed to get repository details: %v", err)
+	}
+
+	// Handle different repository formats
+	switch repo.Format {
+	case artifactregistrypb.Repository_DOCKER:
+		return ars.DockerImages(repoFullName)
+	// Placeholder for other formats
+	// case artifactregistrypb.Repository_MAVEN:
+	// 	return listMavenArtifacts(ctx, client, repoFullName)
+	// case artifactregistrypb.Repository_NPM:
+	// 	return listNpmPackages(ctx, client, repoFullName)
+	default:
+		logger.InfoM("Repository format is unsupported, so no artifacts were retrieved.", globals.GCP_ARTIFACT_RESGISTRY_MODULE_NAME)
+		return nil, nil
+	}
+}
+
+// parseDockerImageName parses the Docker image name string and returns the extracted details.
+func parseDockerImageName(imageName string) DockerImageDetails {
+	// Split the image name by '/'
+	parts := strings.Split(imageName, "/")
+
+	// Extract details based on the known structure of the image name.
+	// Assuming the format is always consistent as described.
+	projectID := parts[1]
+	location := parts[3]
+	repository := parts[5]
+	// The image name and digest are after the last '/', separated by '@'
+	imageAndDigest := strings.Split(parts[7], "@")
+	imageName = imageAndDigest[0]
+	digest := imageAndDigest[1]
+
+	return DockerImageDetails{
+		ProjectID:  projectID,
+		Location:   location,
+		Repository: repository,
+		ImageName:  imageName,
+		Digest:     digest,
+	}
+}
+
+// listDockerImages specifically lists Docker images within a given repository.
+func (ars *ArtifactRegistryService) DockerImages(repositoryName string) ([]ArtifactInfo, error) {
+	ctx := context.Background()
+	var artifacts []ArtifactInfo
+
+	req := &artifactregistrypb.ListDockerImagesRequest{
+		Parent: repositoryName,
+	}
+
+	it := ars.Client.ListDockerImages(ctx, req)
+	for {
+		image, err := it.Next()
+		if err == iterator.Done {
+			break
+		}
+		if err != nil {
+			return nil, err
+		}
+
+		// Parse image name to extract detailed information.
+		details := parseDockerImageName(image.Name)
+
+		// Populate the ArtifactInfo structure with Docker image details.
+		artifacts = append(artifacts, ArtifactInfo{
+			Name:       details.ImageName,
+			Format:     "DOCKER",
+			Location:   details.Location,
+			Repository: details.Repository,
+			SizeBytes:  fmt.Sprintf("%d", image.ImageSizeBytes),
+			Updated:    image.UpdateTime.AsTime().String(),
+			Digest:     details.Digest,
+			ProjectID:  details.ProjectID,
+		})
+	}
+
+	return artifacts, nil
+}
+
+// listProjectLocations returns a list of available locations for the given project ID.
+func (ars *ArtifactRegistryService) projectLocations(projectID string) ([]string, error) {
+	// Define the request to list locations.
+	req := &locationpb.ListLocationsRequest{
+		Name: fmt.Sprintf("projects/%s", projectID),
+	}
+
+	// Initialize an empty slice to hold the locations.
+	var locations []string
+
+	// Call the ListLocations method and handle pagination.
+	ctx := context.Background()
+	it := ars.Client.ListLocations(ctx, req)
+	for {
+		loc, err := it.Next()
+		if err == iterator.Done {
+			break
+		}
+		if err != nil {
+			return nil, fmt.Errorf("failed to list locations: %w", err)
+		}
+		locations = append(locations, loc.LocationId)
+	}
+
+	return locations, nil
+}

gcp/services/artifactRegistryService/artifactRegistryService_test.go

@@ -0,0 +1,252 @@
+package artifactregistryservice_test
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"testing"
+
+	artifactRegistryService "github.com/BishopFox/cloudfox/gcp/services/artifactRegistryService"
+	"github.com/BishopFox/cloudfox/gcp/services/models"
+
+	artifactregistrypb "cloud.google.com/go/artifactregistry/apiv1/artifactregistrypb"
+	"github.com/googleapis/gax-go/v2"
+	"google.golang.org/api/iterator"
+	locationpb "google.golang.org/genproto/googleapis/cloud/location"
+)
+
+// Mock structure for ArtifactRegistryClientWrapper
+type mockArtifactRegistryClient struct {
+	repositories []*artifactregistrypb.Repository
+	locations    []*locationpb.Location
+	dockerImages []*artifactregistrypb.DockerImage
+}
+
+func (m *mockArtifactRegistryClient) Close() error {
+	return nil
+}
+
+// Mock iterator for repositories
+type mockRepoIterator struct {
+	repositories []*artifactregistrypb.Repository
+	index        int
+}
+
+func (it *mockRepoIterator) Next() (*artifactregistrypb.Repository, error) {
+	if it.index < len(it.repositories) {
+		repo := it.repositories[it.index]
+		it.index++
+		return repo, nil
+	}
+	return nil, iterator.Done
+}
+
+// Mock iterator for locations
+type mockLocationIterator struct {
+	locations []*locationpb.Location
+	index     int
+}
+
+func (it *mockLocationIterator) Next() (*locationpb.Location, error) {
+	if it.index < len(it.locations) {
+		loc := it.locations[it.index]
+		it.index++
+		return loc, nil
+	}
+	return nil, iterator.Done
+}
+
+// Mock iterator for Docker images
+type mockDockerImageIterator struct {
+	dockerImages []*artifactregistrypb.DockerImage
+	index        int
+}
+
+func (it *mockDockerImageIterator) Next() (*artifactregistrypb.DockerImage, error) {
+	if it.index < len(it.dockerImages) {
+		img := it.dockerImages[it.index]
+		it.index++
+		return img, nil
+	}
+	return nil, iterator.Done
+}
+
+// Mock methods
+func (m *mockArtifactRegistryClient) ListRepositories(ctx context.Context, req *artifactregistrypb.ListRepositoriesRequest, opts ...gax.CallOption) models.GenericIterator[artifactregistrypb.Repository] {
+	return &mockRepoIterator{repositories: m.repositories}
+}
+
+func (m *mockArtifactRegistryClient) ListLocations(ctx context.Context, req *locationpb.ListLocationsRequest, opts ...gax.CallOption) models.GenericIterator[locationpb.Location] {
+	return &mockLocationIterator{locations: m.locations}
+}
+
+func (m *mockArtifactRegistryClient) GetRepository(ctx context.Context, req *artifactregistrypb.GetRepositoryRequest, opts ...gax.CallOption) (*artifactregistrypb.Repository, error) {
+	for _, repo := range m.repositories {
+		if repo.Name == req.Name {
+			return repo, nil
+		}
+	}
+	return nil, fmt.Errorf("repository not found")
+}
+
+func (m *mockArtifactRegistryClient) ListDockerImages(ctx context.Context, req *artifactregistrypb.ListDockerImagesRequest, opts ...gax.CallOption) models.GenericIterator[artifactregistrypb.DockerImage] {
+	return &mockDockerImageIterator{dockerImages: m.dockerImages}
+}
+
+var mockClient = mockArtifactRegistryClient{}
+
+var ars = artifactRegistryService.ArtifactRegistryService{
+	Client: &artifactRegistryService.ArtifactRegistryClientWrapper{
+		Closer: mockClient.Close,
+		RepositoryLister: func(ctx context.Context, req *artifactregistrypb.ListRepositoriesRequest, opts ...gax.CallOption) models.GenericIterator[artifactregistrypb.Repository] {
+			return mockClient.ListRepositories(ctx, req, opts...)
+		},
+		LocationLister: func(ctx context.Context, req *locationpb.ListLocationsRequest, opts ...gax.CallOption) models.GenericIterator[locationpb.Location] {
+			return mockClient.ListLocations(ctx, req, opts...)
+		},
+		RepositoryGetter: func(ctx context.Context, req *artifactregistrypb.GetRepositoryRequest, opts ...gax.CallOption) (*artifactregistrypb.Repository, error) {
+			return mockClient.GetRepository(ctx, req, opts...)
+		},
+		DockerImageLister: func(ctx context.Context, req *artifactregistrypb.ListDockerImagesRequest, opts ...gax.CallOption) models.GenericIterator[artifactregistrypb.DockerImage] {
+			return mockClient.ListDockerImages(ctx, req, opts...)
+		},
+	},
+}
+
+// Tests go here
+func TestArtifacts(t *testing.T) {
+	cases := []struct {
+		name              string
+		projectID         string
+		location          string
+		repositoryName    string
+		setupMockClient   func(client *mockArtifactRegistryClient)
+		expectedArtifacts []artifactRegistryService.ArtifactInfo
+		expectError       bool
+	}{
+		{
+			name:           "Valid artifacts retrieval",
+			projectID:      "project1",
+			location:       "us-central1",
+			repositoryName: "repo1",
+			setupMockClient: func(client *mockArtifactRegistryClient) {
+				client.dockerImages = []*artifactregistrypb.DockerImage{
+					{
+						Name:           "projects/project1/locations/us-central1/repositories/repo1/dockerImages/image1@sha256:e9954c1fc875017be1c3e36eca16be2d9e9bccc4bf072163515467d6a823c7cf",
+						Uri:            "us-central1-docker.pkg.dev/project1/repo1/image1@sha256:e9954c1fc875017be1c3e36eca16be2d9e9bccc4bf072163515467d6a823c7cf",
+						ImageSizeBytes: 1024,
+					},
+				}
+				client.locations = []*locationpb.Location{
+					{
+						LocationId: "us-central1",
+					},
+				}
+				client.repositories = []*artifactregistrypb.Repository{{
+					Name:   "projects/project1/locations/us-central1/repositories/repo1",
+					Format: artifactregistrypb.Repository_DOCKER,
+				},
+				}
+			},
+			expectedArtifacts: []artifactRegistryService.ArtifactInfo{
+				{
+					Name:       "image1",
+					Format:     "DOCKER",
+					Location:   "us-central1",
+					Repository: "repo1",
+					SizeBytes:  "1024",
+					ProjectID:  "project1",
+					Digest:     "sha256:e9954c1fc875017be1c3e36eca16be2d9e9bccc4bf072163515467d6a823c7cf",
+					Updated:    "1970-01-01 00:00:00 +0000 UTC",
+				},
+			},
+			expectError: false,
+		},
+		// Add more test cases here
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Reset mockClient state
+			mockClient.repositories = nil
+			mockClient.locations = nil
+			mockClient.dockerImages = nil
+
+			// Setup mock client for the current test case
+			tc.setupMockClient(&mockClient)
+
+			artifacts, err := ars.Artifacts(tc.projectID, tc.location, tc.repositoryName)
+			if (err != nil) != tc.expectError {
+				t.Errorf("Artifacts() error = %v, expectError %v", err, tc.expectError)
+				return
+			}
+
+			if !reflect.DeepEqual(artifacts, tc.expectedArtifacts) {
+				t.Errorf("Artifacts() = %v, expected %v", artifacts, tc.expectedArtifacts)
+			}
+		})
+	}
+}
+
+func TestRepositories(t *testing.T) {
+	cases := []struct {
+		name                 string
+		projectID            string
+		setupMockClient      func(client *mockArtifactRegistryClient)
+		expectedRepositories []artifactRegistryService.RepositoryInfo
+		expectError          bool
+	}{
+		{
+			name:      "Valid repositories retrieval",
+			projectID: "project1",
+			setupMockClient: func(client *mockArtifactRegistryClient) {
+				client.repositories = []*artifactregistrypb.Repository{
+					{
+						Name:        "projects/project1/locations/us-central1/repositories/repo1",
+						Format:      artifactregistrypb.Repository_DOCKER,
+						Description: "Test repository",
+					},
+				}
+				client.locations = []*locationpb.Location{
+					{
+						LocationId: "us-central1",
+					},
+				}
+			},
+			expectedRepositories: []artifactRegistryService.RepositoryInfo{
+				{
+					Name:        "projects/project1/locations/us-central1/repositories/repo1",
+					Format:      "DOCKER",
+					Description: "Test repository",
+					SizeBytes:   "0",
+					ProjectID:   "project1",
+					Location:    "us-central1",
+				},
+			},
+			expectError: false,
+		},
+		// Add more test cases here
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Reset mockClient state
+			mockClient.repositories = nil
+			mockClient.locations = nil
+			mockClient.dockerImages = nil
+
+			// Setup mock client for the current test case
+			tc.setupMockClient(&mockClient)
+
+			repositories, err := ars.Repositories(tc.projectID)
+			if (err != nil) != tc.expectError {
+				t.Errorf("Repositories() error = %v, expectError %v", err, tc.expectError)
+				return
+			}
+
+			if !reflect.DeepEqual(repositories, tc.expectedRepositories) {
+				t.Errorf("Repositories() = %v, expected %v", repositories, tc.expectedRepositories)
+			}
+		})
+	}
+}

gcp/services/artifactRegistryService/models.go

@@ -0,0 +1,78 @@
+package artifactregistryservice
+
+import (
+	"context"
+
+	artifactregistrypb "cloud.google.com/go/artifactregistry/apiv1/artifactregistrypb"
+	"github.com/BishopFox/cloudfox/gcp/services/models"
+	"github.com/googleapis/gax-go/v2"
+	locationpb "google.golang.org/genproto/googleapis/cloud/location"
+)
+
+// CombinedRepoArtifactInfo holds the combined information of repositories and their respective artifacts.
+type CombinedRepoArtifactInfo struct {
+	Repositories []RepositoryInfo `json:"repositories"`
+	Artifacts    []ArtifactInfo   `json:"artifacts"`
+}
+
+// ArtifactInfo represents the basic information of an artifact within a registry.
+type ArtifactInfo struct {
+	Name       string `json:"name"`
+	Format     string `json:"format"`
+	Version    string `json:"version"`
+	Location   string `json:"location"`
+	Repository string `json:"repository"`
+	SizeBytes  string `json:"virtualSize"`
+	Updated    string `json:"updated"`
+	Digest     string `json:"digest"`
+	ProjectID  string `json:"projectID"`
+}
+
+// RepositoryInfo holds information about a repository and its artifacts.
+type RepositoryInfo struct {
+	Name        string `json:"name"`
+	Format      string `json:"format"`
+	Description string `json:"description"`
+	SizeBytes   string `json:"sizeBytes"`
+	ProjectID   string `json:"projectID"`
+	Location    string `json:"location"`
+}
+
+// DockerImageDetails holds the extracted parts from a Docker image name.
+type DockerImageDetails struct {
+	ProjectID  string `json:"projectID"`
+	Location   string `json:"location"`
+	Repository string `json:"repository"`
+	ImageName  string `json:"name"`
+	Digest     string `json:"digest"`
+}
+
+// Function calls to the API are wrapped to facilitate mocking
+type ArtifactRegistryClientWrapper struct {
+	Closer            func() error
+	RepositoryLister  func(ctx context.Context, req *artifactregistrypb.ListRepositoriesRequest, opts ...gax.CallOption) models.GenericIterator[artifactregistrypb.Repository]
+	LocationLister    func(ctx context.Context, req *locationpb.ListLocationsRequest, opts ...gax.CallOption) models.GenericIterator[locationpb.Location]
+	RepositoryGetter  func(ctx context.Context, req *artifactregistrypb.GetRepositoryRequest, opts ...gax.CallOption) (*artifactregistrypb.Repository, error)
+	DockerImageLister func(ctx context.Context, req *artifactregistrypb.ListDockerImagesRequest, opts ...gax.CallOption) models.GenericIterator[artifactregistrypb.DockerImage]
+}
+
+func (w *ArtifactRegistryClientWrapper) ListRepositories(ctx context.Context, req *artifactregistrypb.ListRepositoriesRequest, opts ...gax.CallOption) models.GenericIterator[artifactregistrypb.Repository] {
+	return w.RepositoryLister(ctx, req, opts...)
+}
+
+func (w *ArtifactRegistryClientWrapper) ListLocations(ctx context.Context, req *locationpb.ListLocationsRequest, opts ...gax.CallOption) models.GenericIterator[locationpb.Location] {
+	return w.LocationLister(ctx, req, opts...)
+}
+
+func (w *ArtifactRegistryClientWrapper) GetRepository(ctx context.Context, req *artifactregistrypb.GetRepositoryRequest, opts ...gax.CallOption) (*artifactregistrypb.Repository, error) {
+	return w.RepositoryGetter(ctx, req, opts...)
+}
+
+func (w *ArtifactRegistryClientWrapper) ListDockerImages(ctx context.Context, req *artifactregistrypb.ListDockerImagesRequest, opts ...gax.CallOption) models.GenericIterator[artifactregistrypb.DockerImage] {
+	return w.DockerImageLister(ctx, req, opts...)
+}
+
+// ArtifactRegistryService provides methods to interact with Artifact Registry resources.
+type ArtifactRegistryService struct {
+	Client *ArtifactRegistryClientWrapper
+}

gcp/services/bigqueryService/bigqueryService.go

@@ -0,0 +1,150 @@
+package bigqueryservice
+
+import (
+	"context"
+	"time"
+
+	"cloud.google.com/go/bigquery"
+	"google.golang.org/api/iterator"
+)
+
+// BigqueryDataset represents a dataset in BigQuery
+type BigqueryDataset struct {
+	DatasetID        string
+	Location         string
+	CreationTime     time.Time
+	LastModifiedTime time.Time
+	Description      string
+	Name             string
+	ProjectID        string
+}
+
+// BigqueryTable represents a table in BigQuery
+type BigqueryTable struct {
+	TableID          string
+	DatasetID        string
+	Location         string
+	CreationTime     time.Time
+	LastModifiedTime time.Time
+	NumBytes         int64
+	Description      string
+	ProjectID        string
+}
+
+// CombinedBigqueryData represents both datasets and tables within a project
+type CombinedBigqueryData struct {
+	Datasets []BigqueryDataset
+	Tables   []BigqueryTable
+}
+
+type BigQueryService struct {
+	// Placeholder for any required services or configuration
+}
+
+// New creates a new instance of BigQueryService
+func New() *BigQueryService {
+	return &BigQueryService{}
+}
+
+// gcloud alpha bq datasets list
+// gcloud alpha bq datasets describe terragoat_dev_dataset
+// gcloud alpha bq tables list --dataset terragoat_dev_dataset
+// gcloud alpha bq tables describe bar --dataset terragoat_dev_dataset
+
+// BigqueryDatasetsAndTables retrieves all datasets and their tables for a given projectID
+func (bq *BigQueryService) BigqueryDatasetsAndTables(projectID string) (CombinedBigqueryData, error) {
+	// Initialize the combined struct to hold datasets and tables
+	combinedData := CombinedBigqueryData{}
+
+	// Retrieve all datasets
+	datasets, err := bq.BigqueryDatasets(projectID)
+	if err != nil {
+		return combinedData, err
+	}
+	combinedData.Datasets = datasets
+
+	// Iterate over each dataset to retrieve its tables
+	for _, dataset := range datasets {
+		tables, err := bq.BigqueryTables(projectID, dataset.DatasetID)
+		if err != nil {
+			return combinedData, err
+		}
+		combinedData.Tables = append(combinedData.Tables, tables...)
+	}
+
+	return combinedData, nil
+}
+
+// BigqueryDatasets retrieves datasets from the given projectID across all locations
+func (bq *BigQueryService) BigqueryDatasets(projectID string) ([]BigqueryDataset, error) {
+	ctx := context.Background()
+	client, err := bigquery.NewClient(ctx, projectID)
+	if err != nil {
+		return nil, err
+	}
+	defer client.Close()
+
+	var datasets []BigqueryDataset
+	it := client.Datasets(ctx)
+	for {
+		ds, err := it.Next()
+		if err == iterator.Done {
+			break
+		}
+		if err != nil {
+			return nil, err
+		}
+		meta, err := ds.Metadata(ctx)
+		if err != nil {
+			return nil, err
+		}
+		datasets = append(datasets, BigqueryDataset{
+			DatasetID:        ds.DatasetID,
+			Location:         meta.Location,
+			CreationTime:     meta.CreationTime,
+			LastModifiedTime: meta.LastModifiedTime,
+			Description:      meta.Description,
+			Name:             meta.Name,
+			ProjectID:        projectID,
+		})
+	}
+	return datasets, nil
+}
+
+// BigqueryTables retrieves tables from the given projectID and dataset across all locations
+func (bq *BigQueryService) BigqueryTables(projectID string, datasetID string) ([]BigqueryTable, error) {
+	ctx := context.Background()
+	client, err := bigquery.NewClient(ctx, projectID)
+	if err != nil {
+		return nil, err
+	}
+	defer client.Close()
+
+	var tables []BigqueryTable
+	ds := client.Dataset(datasetID)
+	it := ds.Tables(ctx)
+	for {
+		table, err := it.Next()
+		if err == iterator.Done {
+			break
+		}
+		if err != nil {
+			return nil, err
+		}
+		meta, err := table.Metadata(ctx)
+		if err != nil {
+			return nil, err
+		}
+		tables = append(tables, BigqueryTable{
+			TableID:          table.TableID,
+			DatasetID:        datasetID,
+			Location:         meta.Location,
+			CreationTime:     meta.CreationTime,
+			LastModifiedTime: meta.LastModifiedTime,
+			NumBytes:         meta.NumBytes,
+			Description:      meta.Description,
+			ProjectID:        projectID,
+		})
+	}
+	return tables, nil
+}

gcp/services/bigqueryService/bigqueryService_test.go

@@ -0,0 +1 @@
+package bigqueryservice_test

gcp/services/cloudStorageService/cloudStorageService.go

@@ -0,0 +1,117 @@
+package cloudstorageservice
+
+import (
+	"context"
+	"fmt"
+
+	"cloud.google.com/go/storage"
+	"google.golang.org/api/iterator"
+)
+
+type CloudStorageService struct {
+	// DataStoreService datastoreservice.DataStoreService
+}
+
+func New() *CloudStorageService {
+	return &CloudStorageService{}
+}
+
+// type ObjectInfo struct {
+// 	ObjectName      string  `json:"objecttName"`
+// 	ObjectSizeBytes float64 `json:"objectSizeBytes"`
+// 	IsPublic        bool    `json:"isPublic"`
+// }
+
+type BucketInfo struct {
+	Name      string `json:"name"`
+	Location  string `json:"location"`
+	ProjectID string `json:"projectID"`
+}
+
+func (cs *CloudStorageService) Buckets(projectID string) ([]BucketInfo, error) {
+	ctx := context.Background()
+	client, err := storage.NewClient(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("Failed to create client: %v", err)
+	}
+	defer client.Close()
+
+	var buckets []BucketInfo
+	bucketIterator := client.Buckets(ctx, projectID)
+	for {
+		battrs, err := bucketIterator.Next()
+		if err == iterator.Done {
+			break
+		}
+		if err != nil {
+			return nil, err
+		}
+		bucket := BucketInfo{Name: battrs.Name, Location: battrs.Location, ProjectID: projectID}
+		buckets = append(buckets, bucket)
+	}
+	return buckets, nil
+}
+
+// func (cs *CloudStorageService) BucketsWithMetaData(projectID string) (map[string][]BucketInfo, error) {
+// 	buckets, _ := cs.Buckets(projectID)
+// 	bucketInfos := make(map[string][]BucketInfo)
+// 	ctx := context.Background()
+// 	client, err := storage.NewClient(ctx)
+// 	if err != nil {
+// 		return nil, fmt.Errorf("Failed to create client: %v", err)
+// 	}
+// 	for {
+// 		bucketAttrs, err := buckets.Next()
+// 		if err == iterator.Done {
+// 			break
+// 		}
+// 		if err != nil {
+// 			return nil, fmt.Errorf("failed to list buckets: %v", err)
+// 		}
+
+// 		bucketName := bucketAttrs.Name
+// 		log.Printf("Working on bucket %s", bucketName)
+
+// 		// List all objects in the bucket and calculate total size
+// 		totalSize := int64(0)
+// 		var objects []ObjectInfo
+// 		it := client.Bucket(bucketName).Objects(ctx, nil)
+// 		for {
+// 			objectAttrs, err := it.Next()
+// 			if err == iterator.Done {
+// 				break
+// 			}
+// 			if err != nil {
+// 				return nil, fmt.Errorf("failed to list objects in bucket %s: %v", bucketName, err)
+// 			}
+
+// 			// Get size
+// 			objectSize := objectAttrs.Size
+// 			totalSize += objectSize
+
+// 			// Check if public
+// 			isPublic := false
+// 			for _, rule := range objectAttrs.ACL {
+// 				if rule.Entity == storage.AllUsers {
+// 					isPublic = true
+// 					break
+// 				}
+// 			}
+
+// 			objects = append(objects, ObjectInfo{ObjectName: objectAttrs.Name, ObjectSizeBytes: float64(objectSize), IsPublic: isPublic})
+
+// 			if totalSize > 3221225472 { // 3 GiB in bytes
+// 				log.Printf("%s bucket is over 3 GiB. Skipping remaining objects in this bucket...", bucketName)
+// 				break
+// 			}
+// 		}
+// 		bucketSizeMB := float64(totalSize) / 1024 / 1024
+// 		bucketInfos[projectID] = append(bucketInfos[projectID], BucketInfo{BucketName: bucketName, BucketSizeMB: bucketSizeMB, Objects: objects})
+// 	}
+// 	log.Printf("Sorting resulting list of buckets in descending order %s", projectID)
+// 	sort.Slice(bucketInfos[projectID], func(i, j int) bool {
+// 		return bucketInfos[projectID][i].BucketSizeMB > bucketInfos[projectID][j].BucketSizeMB
+// 	})
+
+// 	return bucketInfos, nil
+// }

gcp/services/cloudStorageService/cloudStorageService_test.go

@@ -0,0 +1 @@
+package cloudstorageservice_test

gcp/services/computeEngineService/computeEngineService.go

@@ -0,0 +1,99 @@
+package computeengineservice
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"google.golang.org/api/compute/v1"
+)
+
+type ComputeEngineService struct {
+	// DataStoreService datastoreservice.DataStoreService
+}
+
+func New() *ComputeEngineService {
+	return &ComputeEngineService{}
+}
+
+type ComputeEngineInfo struct {
+	Name              string
+	ID                string
+	Zone              string
+	State             string
+	ExternalIP        string
+	InternalIP        string
+	ServiceAccounts   []*compute.ServiceAccount // Assuming role is derived from service accounts
+	NetworkInterfaces []*compute.NetworkInterface
+	Tags              *compute.Tags
+	ProjectID         string
+}
+
+// Retrieves instances from all regions and zones for a project without using concurrency.
+func (ces *ComputeEngineService) Instances(projectID string) ([]ComputeEngineInfo, error) {
+	ctx := context.Background()
+	computeService, err := compute.NewService(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	regions, err := computeService.Regions.List(projectID).Do()
+	if err != nil {
+		return nil, err
+	}
+
+	var instanceInfos []ComputeEngineInfo
+	for _, region := range regions.Items {
+		for _, zoneURL := range region.Zones {
+			zone := getZoneNameFromURL(zoneURL)
+			instanceList, err := computeService.Instances.List(projectID, zone).Do()
+			if err != nil {
+				return nil, fmt.Errorf("error retrieving instances from zone %s: %v", zone, err)
+			}
+			for _, instance := range instanceList.Items {
+				info := ComputeEngineInfo{
+					Name:              instance.Name,
+					ID:                fmt.Sprintf("%v", instance.Id),
+					Zone:              zoneURL,
+					State:             instance.Status,
+					ExternalIP:        getExternalIP(instance),
+					InternalIP:        getInternalIP(instance),
+					ServiceAccounts:   instance.ServiceAccounts,
+					NetworkInterfaces: instance.NetworkInterfaces,
+					Tags:              instance.Tags,
+					ProjectID:         projectID,
+				}
+				instanceInfos = append(instanceInfos, info)
+			}
+		}
+	}
+	return instanceInfos, nil
+}
+
+// Returns the zone from a GCP URL string with the zone in it
+func getZoneNameFromURL(zoneURL string) string {
+	splits := strings.Split(zoneURL, "/")
+	return splits[len(splits)-1]
+}
+
+// getExternalIP extracts the external IP address from an instance if available.
+func getExternalIP(instance *compute.Instance) string {
+	for _, iface := range instance.NetworkInterfaces {
+		for _, accessConfig := range iface.AccessConfigs {
+			if accessConfig.NatIP != "" {
+				return accessConfig.NatIP
+			}
+		}
+	}
+	return ""
+}
+
+// getInternalIP extracts the internal IP address from an instance.
+func getInternalIP(instance *compute.Instance) string {
+	if len(instance.NetworkInterfaces) > 0 {
+		return instance.NetworkInterfaces[0].NetworkIP
+	}
+	return ""
+}
+
+// TODO consider just getting the emails of the service account and returning a []string

gcp/services/computeEngineService/computeEngineService_test.go

@@ -0,0 +1 @@
+package computeengineservice

gcp/services/iamService/access-tokens.go

@@ -0,0 +1,93 @@
+package iamservice
+
+// import (
+// 	"fmt"
+// 	"strings"
+// 	"time"
+// 	"github.com/fatih/color"
+// 	"github.com/BishopFox/cloudfox/internal/gcp"
+// 	"github.com/BishopFox/cloudfox/internal"
+// 	"github.com/BishopFox/cloudfox/globals"
+// )
+
+// type AccessTokensModule struct {
+// 	// Filtering data
+// 	Organizations []string
+// 	Folders []string
+// 	Projects []string
+// }
+
+// // Be incorportated in iam.go
+// func (m *AccessTokensModule) PrintAccessTokens(outputFormat string, outputDirectory string, verbosity int) error {
+// 	GCPLogger.InfoM(fmt.Sprintf("Enumerating GCP local access tokens (%s, %s)...", color.CyanString("default user token"), color.RedString("application-default token")), globals.GCP_ACCESSTOKENS_MODULE_NAME)
+// 	tokens := gcp.ReadRefreshTokens()
+// 	accessTokens := gcp.ReadAccessTokens()
+// 	applicationdefaulthash := gcp.GetDefaultApplicationHash()
+// 	activeAccount := gcp.GetActiveAccount()
+
+// 	var tableHead = []string{"Account", "Credential Type", "Validity", "Refresh Token", "Refresh Token needs password"}
+// 	var tableBody [][]string
+// 	for _, accessToken := range accessTokens {
+// 		// prepare token's associated ID (email or hash)
+// 		var emailinfo string
+// 		if (accessToken.AccountID == activeAccount) {
+// 			emailinfo = color.BlueString(accessToken.AccountID)
+// 		} else {
+// 			emailinfo = accessToken.AccountID
+// 		}
+
+// 		// format expiration time
+// 		Exp, _ := time.Parse(time.RFC3339, accessToken.TokenExpiry)
+// 		var timeinfo string
+// 		if Exp.After(time.Now()) {
+// 			timeinfo = Exp.Format(time.RFC1123)
+// 		} else {
+// 			timeinfo = "EXPIRED"
+// 		}
+
+// 		// display token type, user or application credential
+// 		var tokentype string
+// 		if (strings.Contains(accessToken.AccountID, "@")) {
+// 			tokentype = "User"
+// 		} else {
+// 			tokentype = "Application"
+// 		}
+// 		// is there an associated refres htoken ?
+// 		var refreshtokeninfo string
+// 		refreshtokeninfo = "No"
+// 		for _, refreshtoken := range tokens {
+// 			if (accessToken.AccountID == refreshtoken.Email) {
+// 				refreshtokeninfo = "Yes"
+// 			} else if (accessToken.AccountID == applicationdefaulthash) {
+// 				refreshtokeninfo = "Yes"
+// 				emailinfo = color.RedString(emailinfo)
+// 			}
+// 		}
+
+// 		// is there a proof of reauthentication to use the refresh
+// 		// token ? If not, password is needed
+// 		var raptinfo string
+// 		if refreshtokeninfo == "No" {
+// 			raptinfo = "-"
+// 		} else if accessToken.RaptToken.Valid {
+// 			raptinfo = "No"
+// 		} else {
+// 			if (tokentype == "Application") {
+// 				raptinfo = "TBD"
+// 			} else {
+// 				raptinfo = "Yes"
+// 			}
+// 		}
+// 		tableBody = append(
+// 			tableBody,
+// 			[]string{
+// 				emailinfo,
+// 				tokentype,
+// 				timeinfo,
+// 				refreshtokeninfo,
+// 				raptinfo,
+// 			})
+// 	}
+// 	internal.PrintTableToScreen(tableHead, tableBody, false)
+// 	return nil
+// }

gcp/services/iamService/iamService.go

@@ -0,0 +1,189 @@
+package iamservice
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	iampb "cloud.google.com/go/iam/apiv1/iampb"
+	resourcemanager "cloud.google.com/go/resourcemanager/apiv3"
+	resourcemanagerpb "cloud.google.com/go/resourcemanager/apiv3/resourcemanagerpb"
+	"github.com/BishopFox/cloudfox/globals"
+	"github.com/BishopFox/cloudfox/internal"
+)
+
+type IAMService struct {
+	// DataStoreService datastoreservice.DataStoreService
+}
+
+func New() *IAMService {
+	return &IAMService{}
+}
+
+// AncestryResource represents a single resource in the project's ancestry.
+type AncestryResource struct {
+	Type string `json:"type"`
+	Id   string `json:"id"`
+}
+
+// PolicyBindings represents IAM policy bindings.
+type PolicyBinding struct {
+	Role         string   `json:"role"`
+	Members      []string `json:"members"`
+	ResourceID   string   `json:"resourceID"`
+	ResourceType string
+	PolicyName   string `json:"policyBindings"`
+	Condition    string
+}
+
+type PrincipalWithRoles struct {
+	Name           string
+	Type           string
+	PolicyBindings []PolicyBinding
+	ResourceID     string
+	ResourceType   string
+}
+
+var logger internal.Logger
+
+func projectAncestry(projectID string) ([]AncestryResource, error) {
+	ctx := context.Background()
+	projectsClient, err := resourcemanager.NewProjectsClient(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create projects client: %v", err)
+	}
+	defer projectsClient.Close()
+
+	foldersClient, err := resourcemanager.NewFoldersClient(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create folders client: %v", err)
+	}
+	defer foldersClient.Close()
+
+	resourceID := "projects/" + projectID
+	var ancestry []AncestryResource
+
+	for {
+		if strings.HasPrefix(resourceID, "organizations/") {
+			ancestry = append(ancestry, AncestryResource{Type: "organization", Id: strings.TrimPrefix(resourceID, "organizations/")})
+			break
+		} else if strings.HasPrefix(resourceID, "folders/") {
+			resp, err := foldersClient.GetFolder(ctx, &resourcemanagerpb.GetFolderRequest{Name: resourceID})
+			if err != nil {
+				logger.ErrorM(fmt.Sprintf("failed to access folder %s, %v", resourceID, err), globals.GCP_IAM_MODULE_NAME)
+				break // Stop processing further if a folder is inaccessible
+			}
+			ancestry = append(ancestry, AncestryResource{Type: "folder", Id: strings.TrimPrefix(resp.Name, "folders/")})
+			resourceID = resp.Parent
+		} else if strings.HasPrefix(resourceID, "projects/") {
+			resp, err := projectsClient.GetProject(ctx, &resourcemanagerpb.GetProjectRequest{Name: resourceID})
+			if err != nil {
+				logger.ErrorM(fmt.Sprintf("failed to access project %s, %v", resourceID, err), globals.GCP_IAM_MODULE_NAME)
+				return nil, fmt.Errorf("failed to get project: %v", err)
+			}
+			ancestry = append(ancestry, AncestryResource{Type: "project", Id: strings.TrimPrefix(resp.Name, "projects/")})
+			resourceID = resp.Parent
+		} else {
+			return nil, fmt.Errorf("unknown resource type for: %s", resourceID)
+		}
+	}
+
+	// Reverse the slice as we've built it from child to ancestor
+	for i, j := 0, len(ancestry)-1; i < j; i, j = i+1, j-1 {
+		ancestry[i], ancestry[j] = ancestry[j], ancestry[i]
+	}
+
+	return ancestry, nil
+}
+
+// Policies fetches IAM policy for a given resource and all policies in resource ancestry
+func (s *IAMService) Policies(resourceID string, resourceType string) ([]PolicyBinding, error) {
+	ctx := context.Background()
+	client, err := resourcemanager.NewProjectsClient(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("resourcemanager.NewProjectsClient: %v", err)
+	}
+	defer client.Close()
+
+	var resourceName string
+	switch resourceType {
+	case "project":
+		resourceName = "projects/" + resourceID
+	case "folder":
+		resourceName = "folders/" + resourceID
+	case "organization":
+		resourceName = "organizations/" + resourceID
+	default:
+		return nil, fmt.Errorf("unsupported resource type: %s", resourceType)
+	}
+
+	req := &iampb.GetIamPolicyRequest{
+		Resource: resourceName,
+	}
+
+	// Fetch the IAM policy for the resource
+	policy, err := client.GetIamPolicy(ctx, req)
+	if err != nil {
+		return nil, fmt.Errorf("client.GetIamPolicy: %v", err)
+	}
+
+	// Assemble the policy bindings
+	var policyBindings []PolicyBinding
+	for _, binding := range policy.Bindings {
+		policyBinding := PolicyBinding{
+			Role:         binding.Role,
+			Members:      binding.Members,
+			ResourceID:   resourceID,
+			ResourceType: resourceType,
+			Condition:    binding.Condition.String(),
+			PolicyName:   resourceName + "_policyBindings",
+		}
+		policyBindings = append(policyBindings, policyBinding)
+	}
+
+	return policyBindings, nil
+}
+
+func determinePrincipalType(member string) string {
+	if strings.HasPrefix(member, "user:") {
+		return "User"
+	} else if strings.HasPrefix(member, "serviceAccount:") {
+		return "ServiceAccount"
+	} else if strings.HasPrefix(member, "group:") {
+		return "Group"
+	} else {
+		return "Unknown"
+	}
+}
+
+func (s *IAMService) PrincipalsWithRoles(resourceID string, resourceType string) ([]PrincipalWithRoles, error) {
+	policyBindings, err := s.Policies(resourceID, resourceType)
+	if err != nil {
+		return nil, err
+	}
+
+	principalMap := make(map[string]*PrincipalWithRoles)
+	for _, pb := range policyBindings {
+		for _, member := range pb.Members {
+			principalType := determinePrincipalType(member) // Implement this function based on member prefix
+			if principal, ok := principalMap[member]; ok {
+				principal.PolicyBindings = append(principal.PolicyBindings, pb)
+			} else {
+				principalMap[member] = &PrincipalWithRoles{
+					Name:           member,
+					Type:           principalType,
+					PolicyBindings: []PolicyBinding{pb},
+					ResourceID:     resourceID,
+					ResourceType:   resourceType,
+				}
+			}
+		}
+	}
+
+	var principals []PrincipalWithRoles
+	for _, principal := range principalMap {
+		principals = append(principals, *principal)
+	}
+
+	return principals, nil
+}

gcp/services/iamService/iamService_test.go

@@ -0,0 +1 @@
+package iamservice_test

gcp/services/models/models.go

@@ -0,0 +1,5 @@
+package models
+
+type GenericIterator[T any] interface {
+	Next() (*T, error)
+}

gcp/services/networkService/networkService.go

@@ -0,0 +1,260 @@
+package networkservice
+
+import (
+	"context"
+	"log"
+	"net"
+	"strings"
+
+	ComputeEngineService "github.com/BishopFox/cloudfox/gcp/services/computeEngineService"
+	"google.golang.org/api/compute/v1"
+)
+
+// VPC / network / subnets
+// gcloud compute networks list
+// gcloud compute networks get-effective-firewalls terragoat-dev-network
+// gcloud compute networks subnets list
+// FirewallRule structure for JSON output
+
+// firewall-rules
+// gcloud compute firewall-rules list - `terragoat-dev-firewall`
+
+// forwarding rules (load balancers)
+// gcloud compute forwarding-rules list
+
+// Router & NAT gateways
+// gcloud compute routers list
+// gcloud compute routers nats list --router
+
+// Global network firewall policy
+// gcloud compute network-firewall-policies
+// gcloud compute network-firewall-policies rules list
+// gcloud compute network-firewall-policies associations list
+
+type FirewallRule struct {
+	FWName            string              `json:"fw_name"`
+	Description       string              `json:"description"`
+	Direction         string              `json:"direction"`
+	Allowed           map[string][]string `json:"allowed"`
+	Denied            map[string][]string `json:"denied"`
+	SourceRanges      []string            `json:"source_ranges"`
+	TargetTag         string              `json:"target_tag"`
+	AllowedTraffic    Traffic             `json:"allowed_traffic"`
+	ExposedEndpoints  []Endpoint          `json:"exposed_endpoints"`
+	DestinationRanges []string            `json:"destinatioRanges"`
+	TargetTags        []string            `json:"targetTags"`
+}
+
+type Traffic struct {
+	TCP []string `json:"tcp"`
+	UDP []string `json:"udp"`
+}
+
+type Endpoint struct {
+	IP       string   `json:"ip"`
+	Ports    []string `json:"ports"`
+	Protocol string   `json:"protocol"`
+}
+
+type NetwworkService struct {
+	// DataStoreService datastoreservice.DataStoreService
+}
+
+func New() *NetwworkService {
+	return &NetwworkService{}
+}
+
+// Returns firewall rules for a project.
+func (ns *NetwworkService) FirewallRules(projectID string) ([]*compute.Firewall, error) {
+	ctx := context.Background()
+	computeService, err := compute.NewService(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	firewallList, err := computeService.Firewalls.List(projectID).Do()
+	if err != nil {
+		return nil, err
+	}
+	return firewallList.Items, nil
+}
+
+// Returns firewall rules with additional logic to tag rules that expose resources to the public
+func (ns *NetwworkService) FirewallRulesWithPublicExposure(projectID string) ([]FirewallRule, error) {
+	var results []FirewallRule
+
+	log.Printf("Retrieving firewall rules for project %s", projectID)
+	firewalls, err := ns.FirewallRules(projectID)
+	log.Print("Done")
+	if err != nil {
+		log.Printf("Error fetching firewall rules for project %s: %v", projectID, err)
+		return nil, err
+	}
+	log.Print("Parsing firewall rules")
+	for _, fw := range firewalls {
+		parsedRule, err := parseFirewallRule(fw, projectID)
+		if err != nil {
+			log.Printf("Error parsing firewall rule for project %s: %v", projectID, err)
+			continue
+		}
+		results = append(results, parsedRule)
+	}
+	log.Print("Done")
+	return results, nil
+}
+
+// Returns a list of IPs that are mapped to a given tag. Uses a list of instances
+func getIPAddressesForTargetTag(instances []ComputeEngineService.ComputeEngineInfo, tag string) ([]string, error) {
+	var ips []string
+	for _, instance := range instances {
+		if contains(instance.Tags.Items, tag) {
+			ips = append(ips, instance.NetworkInterfaces[0].NetworkIP)
+		}
+	}
+	return ips, nil
+}
+
+// Returns the zone from a GCP URL string with the zone in it
+func getZoneNameFromURL(zoneURL string) string {
+	splits := strings.Split(zoneURL, "/")
+	return splits[len(splits)-1]
+}
+
+// Returns true of a string is in the given list of strings. Else false
+func contains(slice []string, item string) bool {
+	for _, a := range slice {
+		if a == item {
+			return true
+		}
+	}
+	return false
+}
+
+// Returns true if a string in compute.Firewall.SourceRanges is "0.0.0.0/0"
+func isExposedToInternet(fw *compute.Firewall) bool {
+	for _, rangeVal := range fw.SourceRanges {
+		if rangeVal == "0.0.0.0/0" {
+			return true
+		}
+	}
+	return false
+}
+
+// Returns true if the IP is an internal ipv4 or ipv6 IP
+func IsInternalIP(cidr string) bool {
+	ip, _, err := net.ParseCIDR(cidr)
+	if err != nil {
+		// Try parsing as just an IP (not CIDR)
+		ip = net.ParseIP(cidr)
+		if ip == nil {
+			log.Printf("Error parsing input %s\n", cidr)
+			return false
+		}
+	}
+
+	// Check for IPv4 private ranges
+	if ip.To4() != nil {
+		for _, privateCIDR := range []string{
+			"10.0.0.0/8",
+			"172.16.0.0/12",
+			"192.168.0.0/16",
+		} {
+			_, block, _ := net.ParseCIDR(privateCIDR)
+			if block.Contains(ip) {
+				return true
+			}
+		}
+		return false
+	}
+
+	// Check for IPv6 ULA range fc00::/7
+	// This checks if the first byte of the address is in the range 0xfc to 0xfd
+	if ip[0] == 0xfc || ip[0] == 0xfd {
+		return true
+	}
+
+	return false
+}
+
+// getPublicEndpoints fetches the endpoints exposed to the internet
+// and, if a TargetTag is provided, gets the IP associated with it.
+func getPublicEndpoints(fw *compute.Firewall, projectID string) ([]Endpoint, error) {
+	var exposedEndpoints []Endpoint
+	ces := ComputeEngineService.New()
+	if isExposedToInternet(fw) {
+		for _, allowed := range fw.Allowed {
+			// Handle destination ranges
+			for _, destRange := range fw.DestinationRanges {
+				if !IsInternalIP(destRange) {
+					exposed := Endpoint{
+						IP:       destRange,
+						Ports:    allowed.Ports,
+						Protocol: allowed.IPProtocol,
+					}
+					exposedEndpoints = append(exposedEndpoints, exposed)
+				}
+			}
+
+			// If TargetTag is provided, fetch the associated IP addresses.
+			if len(fw.TargetTags) > 0 {
+				log.Printf("Target tags found, getting their IP...")
+				instances, err := ces.Instances(projectID)
+				if err != nil {
+					log.Printf("Error retrieving instances: %v", err)
+					return nil, err
+				}
+				for _, tag := range fw.TargetTags {
+					ips, err := getIPAddressesForTargetTag(instances, tag)
+					if err != nil {
+						return nil, err
+					}
+					for _, ip := range ips {
+						if !IsInternalIP(ip) {
+							exposed := Endpoint{
+								IP:       ip,
+								Ports:    allowed.Ports,
+								Protocol: allowed.IPProtocol,
+							}
+							exposedEndpoints = append(exposedEndpoints, exposed)
+						}
+					}
+				}
+			}
+		}
+	}
+	return exposedEndpoints, nil
+}
+
+// The original parseFirewallRule function
+func parseFirewallRule(fw *compute.Firewall, projectID string) (FirewallRule, error) {
+	var exposedEndpoints []Endpoint
+	trafficAllowed := make(map[string][]string)
+	trafficDenied := make(map[string][]string)
+
+	for _, allowed := range fw.Allowed {
+		trafficAllowed[allowed.IPProtocol] = append(trafficAllowed[allowed.IPProtocol], allowed.Ports...)
+	}
+
+	exposedEndpoints, err := getPublicEndpoints(fw, projectID)
+	if err != nil {
+		return FirewallRule{}, err
+	}
+
+	for _, denied := range fw.Denied {
+		trafficDenied[denied.IPProtocol] = append(trafficDenied[denied.IPProtocol], denied.Ports...)
+	}
+
+	return FirewallRule{
+		FWName:           fw.Name,
+		Description:      fw.Description,
+		Direction:        fw.Direction,
+		Allowed:          trafficAllowed,
+		Denied:           trafficDenied,
+		SourceRanges:     fw.SourceRanges,
+		TargetTag:        strings.Join(fw.TargetTags, ","),
+		ExposedEndpoints: exposedEndpoints,
+	}, nil
+}
+
+// TODO
+// func (ns *NetworkService) ForwardingRules() {}

gcp/services/networkService/networkService_test.go

@@ -0,0 +1,35 @@
+package networkservice_test
+
+import (
+	"testing"
+
+	networkservice "github.com/BishopFox/cloudfox/gcp/services/networkService"
+)
+
+func TestIsInternalIP(t *testing.T) {
+	tests := []struct {
+		input  string
+		expect bool
+	}{
+		// IPv4 tests
+		{"10.1.2.3", true},     // falls within 10.0.0.0/8
+		{"172.17.0.1", true},   // falls within 172.16.0.0/12
+		{"192.168.10.1", true}, // falls within 192.168.0.0/16
+		{"11.1.2.3", false},    // public IP
+		{"172.32.0.1", false},  // public IP
+		{"192.169.0.1", false}, // public IP
+		{"8.8.8.8", false},     // public IP
+		// IPv6 tests
+		{"fc00::1", true},               // falls within fc00::/7
+		{"fd00::1", true},               // falls within fd00::/8
+		{"fe80::1", false},              // link-local address, not ULA
+		{"2001:0db8:85a3::8a2e", false}, // public IP
+	}
+
+	for _, test := range tests {
+		result := networkservice.IsInternalIP(test.input)
+		if result != test.expect {
+			t.Errorf("IsInternalIP(%s) = %v; want %v", test.input, result, test.expect)
+		}
+	}
+}

gcp/services/oauthService/oauthService.go

@@ -0,0 +1,84 @@
+package oauthservice
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+
+	"golang.org/x/oauth2/google"
+)
+
+// Principal struct modified to map JSON response fields.
+type Principal struct {
+	Email string `json:"email"`
+	Scope []string
+}
+
+// Temporary struct to match the JSON structure.
+type tokenInfoResponse struct {
+	Email string `json:"email"`
+	Scope string `json:"scope"` // Keep as string to match JSON.
+}
+
+// OAuthService struct definition (unchanged)
+type OAuthService struct {
+	// This struct can be expanded in the future if necessary.
+}
+
+// NewOAuthService creates a new instance of OAuthService.
+func NewOAuthService() *OAuthService {
+	return &OAuthService{}
+}
+
+// WhoAmI function returns the Principal struct showing the email and scope of the currently authenticated user by generating an oauth token
+func (s *OAuthService) WhoAmI() (*Principal, error) {
+	ctx := context.Background()
+	ts, err := google.DefaultTokenSource(ctx, "")
+	if err != nil {
+		return nil, fmt.Errorf("failed to obtain default token source: %v", err)
+	}
+
+	token, err := ts.Token()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get token from token source: %v", err)
+	}
+
+	tokenInfo, err := queryTokenInfo(token.AccessToken)
+	if err != nil {
+		return nil, fmt.Errorf(fmt.Sprintf("failed to retrieve metada of the token with error: %s", err.Error()))
+	}
+	// Split the scope string into a slice of strings.
+	scopes := strings.Split(tokenInfo.Scope, " ")
+
+	return &Principal{
+		Email: tokenInfo.Email,
+		Scope: scopes,
+	}, nil
+}
+
+// queryTokenInfo function modified to return (*Principal, error).
+func queryTokenInfo(accessToken string) (*tokenInfoResponse, error) {
+	url := fmt.Sprintf("https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=%s", accessToken)
+
+	resp, err := http.Get(url)
+	if err != nil {
+		return nil, fmt.Errorf("error making request to tokeninfo endpoint: %v", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("error reading tokeninfo response body: %v", err)
+	}
+
+	var response tokenInfoResponse
+	// Unmarshal the JSON response body into the Principal struct.
+	if err := json.Unmarshal(body, &response); err != nil {
+		return nil, fmt.Errorf("error unmarshalling tokeninfo response body: %v", err)
+	}
+
+	return &response, nil
+}

gcp/services/secretsService/secretsService.go

@@ -0,0 +1,83 @@
+package secretservice
+
+import (
+	"context"
+	"fmt"
+
+	secretmanager "cloud.google.com/go/secretmanager/apiv1"
+	secretmanagerpb "cloud.google.com/go/secretmanager/apiv1/secretmanagerpb"
+	"github.com/googleapis/gax-go/v2"
+	"google.golang.org/api/iterator"
+)
+
+// Wrappers and abstracting types to facilitate mocking the client responses
+type Iterator interface {
+	Next() (*secretmanagerpb.Secret, error)
+}
+
+type SecretsManagerClientWrapper struct {
+	Closer       func() error
+	SecretLister func(ctx context.Context, req *secretmanagerpb.ListSecretsRequest, opts ...gax.CallOption) Iterator
+}
+
+func (w *SecretsManagerClientWrapper) Close() error {
+	return w.Closer()
+}
+
+func (w *SecretsManagerClientWrapper) ListSecrets(ctx context.Context, req *secretmanagerpb.ListSecretsRequest, opts ...gax.CallOption) Iterator {
+	return w.SecretLister(ctx, req, opts...)
+
+}
+
+type SecretsService struct {
+	Client *SecretsManagerClientWrapper
+}
+
+// New function to facilitate using the ss client
+func New(client *secretmanager.Client) SecretsService {
+	ss := SecretsService{
+		Client: &SecretsManagerClientWrapper{
+			Closer: client.Close,
+			SecretLister: func(ctx context.Context, req *secretmanagerpb.ListSecretsRequest, opts ...gax.CallOption) Iterator {
+				return client.ListSecrets(ctx, req, opts...)
+			},
+		},
+	}
+	return ss
+}
+
+type SecretInfo struct {
+	Name         string            `json:"name"`
+	ProjectID    string            `json:"projectID"`
+	CreationTime string            `json:"creationTime"`
+	Labels       map[string]string `json:"labels"`
+	Rotation     string            `json:"rotation,omitempty"`
+}
+
+func (ss *SecretsService) Secrets(projectID string) ([]SecretInfo, error) {
+	var secrets []SecretInfo
+	req := &secretmanagerpb.ListSecretsRequest{
+		Parent: fmt.Sprintf("projects/%s", projectID),
+	}
+
+	ctx := context.Background()
+	it := ss.Client.ListSecrets(ctx, req)
+	for {
+		resp, err := it.Next() //Here it errors out
+		if err == iterator.Done {
+			break
+		}
+		if err != nil {
+			return nil, fmt.Errorf("failed to list secrets: %v", err)
+		}
+
+		secrets = append(secrets, SecretInfo{
+			Name:         resp.Name,
+			ProjectID:    projectID,
+			CreationTime: resp.CreateTime.AsTime().String(),
+			Labels:       resp.Labels,
+			Rotation:     resp.Rotation.String(),
+		})
+	}
+	return secrets, nil
+}

gcp/services/secretsService/secretsService_test.go

@@ -0,0 +1,157 @@
+package secretservice_test
+
+import (
+	"context"
+	"reflect"
+	"testing"
+	"time"
+
+	secretmanagerpb "cloud.google.com/go/secretmanager/apiv1/secretmanagerpb"
+	secretservice "github.com/BishopFox/cloudfox/gcp/services/secretsService"
+	"github.com/googleapis/gax-go/v2"
+	"google.golang.org/api/iterator"
+	"google.golang.org/protobuf/types/known/timestamppb"
+)
+
+type mockSecretManagerClient struct {
+	secrets []*secretmanagerpb.Secret
+}
+
+func (m *mockSecretManagerClient) Close() error {
+	return nil
+}
+
+// SecretIterator simulates the iterator over secrets.
+type SecretIterator struct {
+	secrets          []*secretmanagerpb.Secret // Current secrets batch
+	nextIndex        int                       // Index of the next secret to return
+	InternalFetch    func(pageSize int, pageToken string) (results []*secretmanagerpb.Secret, nextPageToken string, err error)
+	currentPageToken string
+}
+
+func (it *SecretIterator) Next() (*secretmanagerpb.Secret, error) {
+	// If we have reached the end of the current secrets batch, attempt to fetch the next batch
+	if it.nextIndex >= len(it.secrets) {
+		var err error
+		it.secrets, it.currentPageToken, err = it.InternalFetch(10, it.currentPageToken) // Assuming a fixed page size for simplicity
+		if err != nil {
+			return nil, err // Propagate errors from fetch
+		}
+		it.nextIndex = 0 // Reset the index for the new batch
+
+		// If the fetched batch is empty, we have reached the end of the iteration
+		if len(it.secrets) == 0 {
+			return nil, iterator.Done
+		}
+	}
+
+	// Retrieve the next secret and increment the index
+	secret := it.secrets[it.nextIndex]
+	it.nextIndex++
+	return secret, nil
+}
+
+// ListSecrets simulates the ListSecrets method of the SecretManagerClient interface.
+func (m *mockSecretManagerClient) ListSecrets(ctx context.Context, req *secretmanagerpb.ListSecretsRequest, opts ...gax.CallOption) secretservice.Iterator {
+	it := &SecretIterator{}
+
+	// Copy secrets to avoid modifying the original slice
+	allSecrets := make([]*secretmanagerpb.Secret, len(m.secrets))
+	copy(allSecrets, m.secrets)
+
+	// Simulate internal fetch by setting InternalFetch to a function that returns the next set of secrets
+	nextIndex := 0
+	it.InternalFetch = func(pageSize int, pageToken string) (results []*secretmanagerpb.Secret, nextPageToken string, err error) {
+		// Check if we have reached the end of the secrets slice
+		if nextIndex >= len(allSecrets) {
+			return nil, "", iterator.Done
+		}
+
+		// Determine the slice of secrets to return
+		endIndex := nextIndex + pageSize
+		if endIndex > len(allSecrets) {
+			endIndex = len(allSecrets)
+		}
+		results = allSecrets[nextIndex:endIndex]
+		nextIndex = endIndex
+
+		// Simulate the nextPageToken logic (omitted for brevity, always return empty string in this mock)
+		nextPageToken = ""
+		return results, nextPageToken, nil
+	}
+
+	return it
+}
+
+func TestSecrets(t *testing.T) {
+	mockClient := &mockSecretManagerClient{}
+	ss := secretservice.SecretsService{
+		Client: &secretservice.SecretsManagerClientWrapper{
+			Closer: mockClient.Close,
+			SecretLister: func(ctx context.Context, req *secretmanagerpb.ListSecretsRequest, opts ...gax.CallOption) secretservice.Iterator {
+				return mockClient.ListSecrets(ctx, req, opts...)
+			},
+		},
+	}
+
+	tests := []struct {
+		name      string
+		projectID string
+		secrets   []*secretmanagerpb.Secret
+		want      []secretservice.SecretInfo
+		wantErr   bool
+	}{
+		{
+			name:      "Retrieve secrets successfully",
+			projectID: "my-project",
+			secrets: []*secretmanagerpb.Secret{
+				{
+					Name:       "projects/my-project/secrets/secret1",
+					Labels:     map[string]string{"env": "test"},
+					CreateTime: timestamppb.New(time.Date(2020, 1, 1, 0, 0, 0, 0, time.UTC)),
+				},
+			},
+			want: []secretservice.SecretInfo{
+				{
+					Name:         "projects/my-project/secrets/secret1",
+					ProjectID:    "my-project",
+					CreationTime: time.Date(2020, 1, 1, 0, 0, 0, 0, time.UTC).String(),
+					Labels:       map[string]string{"env": "test"},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name:      "No secrets found",
+			projectID: "empty-project",
+			secrets:   []*secretmanagerpb.Secret{},
+			want:      []secretservice.SecretInfo{},
+			wantErr:   false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			mockClient.secrets = tt.secrets
+			got, err := ss.Secrets(tt.projectID) // Adapt this call to match the actual method signature
+			if (err != nil) != tt.wantErr {
+				t.Errorf("[%s] Secrets() error = %v, wantErr %v", tt.name, err, tt.wantErr)
+				return
+			}
+
+			if len(got) != len(tt.want) {
+				t.Errorf("[%s] Secrets() got length = %v, want length %v", tt.name, len(got), len(tt.want))
+				return
+			}
+
+			for i, g := range got {
+				w := tt.want[i]
+
+				// Compare Name, Labels, and CreationTime as string
+				if g.Name != w.Name || !reflect.DeepEqual(g.Labels, w.Labels) || g.CreationTime != w.CreationTime {
+					t.Errorf("Secrets() got = %v, want %v", g, w)
+				}
+			}
+		})
+	}
+}

globals/gcp.go

@@ -0,0 +1,17 @@
+package globals
+
+// Module names
+// const GCP_WHOAMI_MODULE_NAME = "whoami"
+const GCP_ARTIFACT_RESGISTRY_MODULE_NAME string = "artifact-registry"
+const GCP_BIGQUERY_MODULE_NAME string = "bigquery"
+const GCP_BUCKETS_MODULE_NAME string = "buckets"
+const GCP_INSTANCES_MODULE_NAME string = "instances"
+const GCP_IAM_MODULE_NAME string = "iam"
+const GCP_SECRETS_MODULE_NAME string = "secrets"
+const GCP_WHOAMI_MODULE_NAME string = "whoami"
+
+// const GCP_INVENTORY_MODULE_NAME string = "inventory"
+// const GCP_GCLOUD_REFRESH_TOKENS_DB_PATH = ".config/gcloud/credentials.db"
+// const GCP_GCLOUD_ACCESS_TOKENS_DB_PATH = ".config/gcloud/access_tokens.db"
+// const GCP_GCLOUD_DEFAULT_CONFIG_PATH = ".config/gcloud/configurations/config_default"
+// const GCP_GCLOUD_APPLICATION_DEFAULT_PATH = ".config/gcloud/application_default_credentials.json"

globals/utils.go

@@ -4,3 +4,4 @@ const CLOUDFOX_USER_AGENT = "cloudfox"
 const CLOUDFOX_LOG_FILE_DIR_NAME = ".cloudfox"
 const CLOUDFOX_BASE_DIRECTORY = "cloudfox-output"
 const LOOT_DIRECTORY_NAME = "loot"
+const CLOUDFOX_VERSION = "1.13.5"

go.mod

@@ -3,6 +3,12 @@ module github.com/BishopFox/cloudfox
 go 1.21.2
 
 require (
+	cloud.google.com/go/artifactregistry v1.14.6
+	cloud.google.com/go/bigquery v1.57.1
+	cloud.google.com/go/iam v1.1.5
+	cloud.google.com/go/resourcemanager v1.9.4
+	cloud.google.com/go/secretmanager v1.11.4
+	cloud.google.com/go/storage v1.35.1
 	github.com/Azure/azure-sdk-for-go v68.0.0+incompatible
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.4.0
 	github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0
@@ -10,7 +16,7 @@ require (
 	github.com/Azure/go-autorest/autorest v0.11.29
 	github.com/Azure/go-autorest/autorest/azure/auth v0.5.12
 	github.com/aquasecurity/table v1.8.0
-	github.com/aws/aws-sdk-go-v2 v1.24.0
+	github.com/aws/aws-sdk-go-v2 v1.24.1
 	github.com/aws/aws-sdk-go-v2/config v1.26.2
 	github.com/aws/aws-sdk-go-v2/service/apigateway v1.21.6
 	github.com/aws/aws-sdk-go-v2/service/apigatewayv2 v1.18.6
@@ -52,8 +58,10 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/sts v1.26.6
 	github.com/aws/smithy-go v1.19.0
 	github.com/bishopfox/awsservicemap v1.0.3
+	github.com/bishopfox/knownawsaccountslookup v0.0.0-20231228165844-c37ef8df33cb
 	github.com/dominikbraun/graph v0.23.0
 	github.com/fatih/color v1.16.0
+	github.com/googleapis/gax-go/v2 v2.12.0
 	github.com/jedib0t/go-pretty v4.3.0+incompatible
 	github.com/kyokomi/emoji v2.2.4+incompatible
 	github.com/patrickmn/go-cache v2.1.0+incompatible
@@ -61,11 +69,45 @@ require (
 	github.com/spf13/afero v1.11.0
 	github.com/spf13/cobra v1.8.0
 	golang.org/x/crypto v0.17.0
+	golang.org/x/oauth2 v0.15.0
+	google.golang.org/api v0.152.0
+	google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17
+	google.golang.org/protobuf v1.31.0
 )
 
 require (
-	github.com/bishopfox/knownawsaccountslookup v0.0.0-20231228165844-c37ef8df33cb // indirect
+	cloud.google.com/go v0.110.10 // indirect
+	cloud.google.com/go/compute v1.23.3 // indirect
+	cloud.google.com/go/compute/metadata v0.2.3 // indirect
+	cloud.google.com/go/longrunning v0.5.4 // indirect
+	github.com/andybalholm/brotli v1.0.4 // indirect
+	github.com/apache/arrow/go/v12 v12.0.0 // indirect
+	github.com/apache/thrift v0.16.0 // indirect
+	github.com/goccy/go-json v0.9.11 // indirect
 	github.com/golang-jwt/jwt/v5 v5.2.0 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/golang/snappy v0.0.4 // indirect
+	github.com/google/flatbuffers v2.0.8+incompatible // indirect
+	github.com/google/s2a-go v0.1.7 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
+	github.com/klauspost/asmfmt v1.3.2 // indirect
+	github.com/klauspost/compress v1.15.9 // indirect
+	github.com/klauspost/cpuid/v2 v2.0.9 // indirect
+	github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8 // indirect
+	github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3 // indirect
+	github.com/pierrec/lz4/v4 v4.1.15 // indirect
+	github.com/zeebo/xxh3 v1.0.2 // indirect
+	go.opencensus.io v0.24.0 // indirect
+	golang.org/x/mod v0.10.0 // indirect
+	golang.org/x/sync v0.5.0 // indirect
+	golang.org/x/time v0.5.0 // indirect
+	golang.org/x/tools v0.9.1 // indirect
+	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
+	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f // indirect
+	google.golang.org/grpc v1.59.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
 
@@ -85,8 +127,8 @@ require (
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4 // indirect
 	github.com/aws/aws-sdk-go-v2/credentials v1.16.13
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.10 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.9 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.9 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.9 // indirect
 	github.com/aws/aws-sdk-go-v2/service/athena v1.37.3
@@ -100,7 +142,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.2.9 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.8.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.9 // indirect
 	github.com/aws/aws-sdk-go-v2/service/kinesis v1.24.6
 	github.com/aws/aws-sdk-go-v2/service/sfn v1.24.6

go.sum

@@ -1,3 +1,26 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.110.10 h1:LXy9GEO+timppncPIAZoOj3l58LIU9k+kn48AN7IO3Y=
+cloud.google.com/go v0.110.10/go.mod h1:v1OoFqYxiBkUrruItNM3eT4lLByNjxmJSV/xDKJNnic=
+cloud.google.com/go/artifactregistry v1.14.6 h1:/hQaadYytMdA5zBh+RciIrXZQBWK4vN7EUsrQHG+/t8=
+cloud.google.com/go/artifactregistry v1.14.6/go.mod h1:np9LSFotNWHcjnOgh8UVK0RFPCTUGbO0ve3384xyHfE=
+cloud.google.com/go/bigquery v1.57.1 h1:FiULdbbzUxWD0Y4ZGPSVCDLvqRSyCIO6zKV7E2nf5uA=
+cloud.google.com/go/bigquery v1.57.1/go.mod h1:iYzC0tGVWt1jqSzBHqCr3lrRn0u13E8e+AqowBsDgug=
+cloud.google.com/go/compute v1.23.3 h1:6sVlXXBmbd7jNX0Ipq0trII3e4n1/MsADLK6a+aiVlk=
+cloud.google.com/go/compute v1.23.3/go.mod h1:VCgBUoMnIVIR0CscqQiPJLAG25E3ZRZMzcFZeQ+h8CI=
+cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
+cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
+cloud.google.com/go/datacatalog v1.18.3 h1:zmdxP6nOjN5Qb1rtu9h4kbEVwerQ6Oshf+t747QJUew=
+cloud.google.com/go/datacatalog v1.18.3/go.mod h1:5FR6ZIF8RZrtml0VUao22FxhdjkoG+a0866rEnObryM=
+cloud.google.com/go/iam v1.1.5 h1:1jTsCu4bcsNsE4iiqNT5SHwrDRCfRmIaaaVFhRveTJI=
+cloud.google.com/go/iam v1.1.5/go.mod h1:rB6P/Ic3mykPbFio+vo7403drjlgvoWfYpJhMXEbzv8=
+cloud.google.com/go/longrunning v0.5.4 h1:w8xEcbZodnA2BbW6sVirkkoC+1gP8wS57EUUgGS0GVg=
+cloud.google.com/go/longrunning v0.5.4/go.mod h1:zqNVncI0BOP8ST6XQD1+VcvuShMmq7+xFSzOL++V0dI=
+cloud.google.com/go/resourcemanager v1.9.4 h1:JwZ7Ggle54XQ/FVYSBrMLOQIKoIT/uer8mmNvNLK51k=
+cloud.google.com/go/resourcemanager v1.9.4/go.mod h1:N1dhP9RFvo3lUfwtfLWVxfUWq8+KUQ+XLlHLH3BoFJ0=
+cloud.google.com/go/secretmanager v1.11.4 h1:krnX9qpG2kR2fJ+u+uNyNo+ACVhplIAS4Pu7u+4gd+k=
+cloud.google.com/go/secretmanager v1.11.4/go.mod h1:wreJlbS9Zdq21lMzWmJ0XhWW2ZxgPeahsqeV/vZoJ3w=
+cloud.google.com/go/storage v1.35.1 h1:B59ahL//eDfx2IIKFBeT5Atm9wnNmj3+8xG/W4WB//w=
+cloud.google.com/go/storage v1.35.1/go.mod h1:M6M/3V/D3KpzMTJyPOR/HU6n2Si5QdaXYEsng2xgOs8=
 github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU=
 github.com/Azure/azure-sdk-for-go v68.0.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.9.1 h1:lGlwhPtrX6EVml1hO0ivjkUxsSyl4dsiw9qcA1k/3IQ=
@@ -7,10 +30,13 @@ github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.4.0/go.mod h1:1fXstnBMas5kzG
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.1 h1:6oNBlSdi1QqM1PNW7FPA6xOGA5UNsXnkaYZz9vdPGhA=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.1/go.mod h1:s4kgfzA0covAXNicZHDMN58jExvcng2mC/DepXiF1EI=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v2 v2.0.0 h1:PTFGRSlMKCQelWwxUyYVEUqseBJVemLyqWJjvMyt0do=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v2 v2.0.0/go.mod h1:LRr2FzBTQlONPPa5HREE5+RjSCTXl7BwOvYOaWTqCaI=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/managementgroups/armmanagementgroups v1.0.0 h1:pPvTJ1dY0sA35JOeFq6TsY2xj6Z85Yo23Pj4wCCvu4o=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/managementgroups/armmanagementgroups v1.0.0/go.mod h1:mLfWfj8v3jfWKsL9G4eoBoXVcsqcIUTapmdKy7uGOp0=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0 h1:Dd+RhdJn0OTtVGaeDLZpcumkIVCtA/3/Fo42+eoYvVM=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.2.0/go.mod h1:5kakwfW5CjC9KK+Q4wjXAg+ShuIm2mBMua0ZFj2C8PE=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.5.0 h1:AifHbc4mg0x9zW52WOpKbsHaDKuRhlI7TVl47thgQ70=
+github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.5.0/go.mod h1:T5RfihdXtBDxt1Ch2wobif3TvzTdumDy29kahv6AV9A=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.2.1 h1:AMf7YbZOZIW5b66cXNHMWWT/zkjhz5+a+k/3x40EO7E=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.2.1/go.mod h1:uwfk06ZBcvL/g4VHNjurPfVln9NMbsk2XIZxJ+hu81k=
 github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs=
@@ -42,12 +68,21 @@ github.com/Azure/go-autorest/tracing v0.6.0 h1:TYi4+3m5t6K48TGI9AUdb+IzbnSxvnvUM
 github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.2.0 h1:hVeq+yCyUi+MsoO/CU95yqCIcdzra5ovzk8Q2BBpV2M=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.2.0/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c h1:RGWPOewvKIROun94nF7v2cua9qP+thov/7M50KEoeSU=
+github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c/go.mod h1:X0CRv0ky0k6m906ixxpzmDRLvX58TFUKS2eePweuyxk=
+github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY=
+github.com/andybalholm/brotli v1.0.4/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
+github.com/apache/arrow/go/v12 v12.0.0 h1:xtZE63VWl7qLdB0JObIXvvhGjoVNrQ9ciIHG2OK5cmc=
+github.com/apache/arrow/go/v12 v12.0.0/go.mod h1:d+tV/eHZZ7Dz7RPrFKtPK02tpr+c9/PEd/zm8mDS9Vg=
+github.com/apache/thrift v0.16.0 h1:qEy6UW60iVOlUy+b9ZR0d5WzUWYGOo4HfopoyBaNmoY=
+github.com/apache/thrift v0.16.0/go.mod h1:PHK3hniurgQaNMZYaCLEqXKsYK8upmhPbmdP2FXSqgU=
 github.com/aquasecurity/table v1.8.0 h1:9ntpSwrUfjrM6/YviArlx/ZBGd6ix8W+MtojQcM7tv0=
 github.com/aquasecurity/table v1.8.0/go.mod h1:eqOmvjjB7AhXFgFqpJUEE/ietg7RrMSJZXyTN8E/wZw=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/aws/aws-sdk-go-v2 v1.24.0 h1:890+mqQ+hTpNuw0gGP6/4akolQkSToDJgHfQE7AwGuk=
-github.com/aws/aws-sdk-go-v2 v1.24.0/go.mod h1:LNh45Br1YAkEKaAqvmE1m8FUx6a5b/V0oAKV7of29b4=
+github.com/aws/aws-sdk-go-v2 v1.24.1 h1:xAojnj+ktS95YZlDf0zxWBkbFtymPeDP+rvUQIH3uAU=
+github.com/aws/aws-sdk-go-v2 v1.24.1/go.mod h1:LNh45Br1YAkEKaAqvmE1m8FUx6a5b/V0oAKV7of29b4=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4 h1:OCs21ST2LrepDfD3lwlQiOqIGp6JiEUqG84GzTDoyJs=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4/go.mod h1:usURWEKSNNAcAZuzRn/9ZYPT8aZQkR7xcCtunK/LkJo=
 github.com/aws/aws-sdk-go-v2/config v1.26.2 h1:+RWLEIWQIGgrz2pBPAUoGgNGs1TOyF4Hml7hCnYj2jc=
@@ -56,10 +91,10 @@ github.com/aws/aws-sdk-go-v2/credentials v1.16.13 h1:WLABQ4Cp4vXtXfOWOS3MEZKr6AA
 github.com/aws/aws-sdk-go-v2/credentials v1.16.13/go.mod h1:Qg6x82FXwW0sJHzYruxGiuApNo31UEtJvXVSZAXeWiw=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.10 h1:w98BT5w+ao1/r5sUuiH6JkVzjowOKeOJRHERyy1vh58=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.10/go.mod h1:K2WGI7vUvkIv1HoNbfBA1bvIZ+9kL3YVmWxeKuLQsiw=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.9 h1:v+HbZaCGmOwnTTVS86Fleq0vPzOd7tnJGbFhP0stNLs=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.9/go.mod h1:Xjqy+Nyj7VDLBtCMkQYOw1QYfAEZCVLrfI0ezve8wd4=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.9 h1:N94sVhRACtXyVcjXxrwK1SKFIJrA9pOJ5yu2eSHnmls=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.9/go.mod h1:hqamLz7g1/4EJP+GH5NBhcUMLjW+gKLQabgyz6/7WAU=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10 h1:vF+Zgd9s+H4vOXd5BMaPWykta2a6Ih0AKLq/X6NYKn4=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10/go.mod h1:6BkRjejp/GR4411UGqkX8+wFMbFbqsUIimfK4XjOKR4=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10 h1:nYPe006ktcqUji8S2mqXf9c/7NdiKriOwMvWQHgYztw=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10/go.mod h1:6UV4SZkVvmODfXKql4LCbaZUpF7HO2BX38FgBf9ZOLw=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 h1:GrSw8s0Gs/5zZ0SX+gX4zQjRnRsMJDJ2sLur1gRBhEM=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2/go.mod h1:6fQQgfuGmw8Al/3M2IgIllycxV7ZW7WCdVSqfBeUiCY=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.9 h1:ugD6qzjYtB7zM5PN/ZIeaAIyefPaD82G8+SJopgvUpw=
@@ -128,8 +163,8 @@ github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.2.9 h1:/90OR2XbSYfXucB
 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.2.9/go.mod h1:dN/Of9/fNZet7UrQQ6kTDo/VSwKPIq94vjlU16bRARc=
 github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.8.10 h1:h8uweImUHGgyNKrxIUwpPs6XiH0a6DJ17hSJvFLgPAo=
 github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.8.10/go.mod h1:LZKVtMBiZfdvUWgwg61Qo6kyAmE5rn9Dw36AqnycvG8=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.9 h1:Nf2sHxjMJR8CSImIVCONRi4g0Su3J+TSTbS7G0pUeMU=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.9/go.mod h1:idky4TER38YIjr2cADF1/ugFMKvZV7p//pVeV5LZbF0=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10 h1:DBYTXwIGQSGs9w4jKm60F5dmCQ3EEruxdc0MFh+3EY4=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10/go.mod h1:wohMUQiFdzo0NtxbBg0mSRGZ4vL3n0dKjLTINdcIino=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.9 h1:iEAeF6YC3l4FzlJPP9H3Ko1TXpdjdqWffxXjp8SY6uk=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.9/go.mod h1:kjsXoK23q9Z/tLBrckZLLyvjhZoS+AGrzqzUfEClvMM=
 github.com/aws/aws-sdk-go-v2/service/kinesis v1.24.6 h1:FO/aIHk86VePDUh/3Q/A5pnvu45miO1GZB8rIq2BUlA=
@@ -180,6 +215,9 @@ github.com/bishopfox/awsservicemap v1.0.3 h1:0T+mJLwG+vQV9+o3dzwzxhWJWE40VpoCLWt
 github.com/bishopfox/awsservicemap v1.0.3/go.mod h1:oy9Fyqh6AozQjShSx+zRNouTlp7k3z3YEMoFkN8rquc=
 github.com/bishopfox/knownawsaccountslookup v0.0.0-20231228165844-c37ef8df33cb h1:ot96tC/kdm0GKV1kl+aXJorqJbyx92R9bjRQvbBmLKU=
 github.com/bishopfox/knownawsaccountslookup v0.0.0-20231228165844-c37ef8df33cb/go.mod h1:2OnSqu4B86+2xGSIE5D4z3Rze9yJ/LNNjNXHhwMR+vY=
+github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -187,25 +225,72 @@ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi/U=
 github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
 github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
+github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
 github.com/dominikbraun/graph v0.23.0 h1:TdZB4pPqCLFxYhdyMFb1TBdFxp8XLcJfTTBQucVPgCo=
 github.com/dominikbraun/graph v0.23.0/go.mod h1:yOjYyogZLY1LSG9E33JWZJiq5k83Qy2C6POAuiViluc=
+github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
 github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
 github.com/go-openapi/errors v0.21.0 h1:FhChC/duCnfoLj1gZ0BgaBmzhJC2SL/sJr8a2vAobSY=
 github.com/go-openapi/errors v0.21.0/go.mod h1:jxNTMUxRCKj65yb/okJGEtahVd7uvWnuWfj53bse4ho=
 github.com/go-openapi/strfmt v0.21.10 h1:JIsly3KXZB/Qf4UzvzJpg4OELH/0ASDQsyk//TTBDDk=
 github.com/go-openapi/strfmt v0.21.10/go.mod h1:vNDMwbilnl7xKiO/Ve/8H8Bb2JIInBnH+lqiw6QWgis=
+github.com/goccy/go-json v0.9.11 h1:/pAaQDLHEoCq/5FFmSKBswWmK6H0e8g4159Kc/X/nqk=
+github.com/goccy/go-json v0.9.11/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
 github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
 github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
 github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-jwt/jwt/v5 v5.2.0 h1:d/ix8ftRUorsN+5eMIlF4T6J8CAt9rch3My2winC1Jw=
 github.com/golang-jwt/jwt/v5 v5.2.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
+github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
+github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/flatbuffers v2.0.8+incompatible h1:ivUb1cGomAB101ZM1T0nOiWz9pSrTMoa9+EiY7igmkM=
+github.com/google/flatbuffers v2.0.8+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
+github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/martian/v3 v3.3.2 h1:IqNFLAmvJOgVlpdEBiQbDc2EwKW77amAycfTuWKdfvw=
+github.com/google/martian/v3 v3.3.2/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
+github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
+github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.5.0 h1:1p67kYwdtXjb0gL0BPiP1Av9wiZPo5A8z2cWkTZ+eyU=
 github.com/google/uuid v1.5.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfFxPRy3Bf7vr3h0cechB90XaQs=
+github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
+github.com/googleapis/gax-go/v2 v2.12.0 h1:A+gCJKdRfqXkr+BIRGtZLibNXf0m1f9E4HG56etFpas=
+github.com/googleapis/gax-go/v2 v2.12.0/go.mod h1:y+aIqrI5eb1YGMVJfuV3185Ts/D7qKpsEkdD5+I6QGU=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jedib0t/go-pretty v4.3.0+incompatible h1:CGs8AVhEKg/n9YbUenWmNStRW2PHJzaeDodcfvRAbIo=
@@ -214,7 +299,17 @@ github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9Y
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
+github.com/klauspost/asmfmt v1.3.2 h1:4Ri7ox3EwapiOjCki+hw14RyKk201CN4rzyCJRFLpK4=
+github.com/klauspost/asmfmt v1.3.2/go.mod h1:AG8TuvYojzulgDAMCnYn50l/5QV3Bs/tp6j0HLHbNSE=
 github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
+github.com/klauspost/compress v1.15.9 h1:wKRjX6JRtDdrE9qwa4b/Cip7ACOshUI4smpCQanqjSY=
+github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU=
+github.com/klauspost/cpuid/v2 v2.0.9 h1:lgaqFMSdTdQYdZ04uHyN2d/eKdOMyi2YLSvlQIBFYa4=
+github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
+github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
+github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/kyokomi/emoji v2.2.4+incompatible h1:np0woGKwx9LiHAQmwZx79Oc0rHpNw3o+3evou4BEPv4=
@@ -226,6 +321,10 @@ github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWE
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
 github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8 h1:AMFGa4R4MiIpspGNG7Z948v4n35fFGB3RR3G/ry4FWs=
+github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8/go.mod h1:mC1jAcsrzbxHt8iiaC+zU4b1ylILSosueou12R++wfY=
+github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3 h1:+n/aFZefKZp7spd8DFdX7uMikMLXX4oubIzJF4kv/wI=
+github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3/go.mod h1:RagcQ7I8IeTMnF8JTXieKnO4Z6JCsikNEzj0DwauVzE=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
@@ -235,13 +334,18 @@ github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
+github.com/pierrec/lz4/v4 v4.1.15 h1:MO0/ucJhngq7299dKLwIMtgTfbkoSPF6AoMYDd8Q4q0=
+github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 h1:KoWmjvw+nsYOo29YJK9vDA65RGE3NrOnUtO7a+RF9HU=
 github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=
 github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
@@ -258,16 +362,26 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
 github.com/xdg-go/scram v1.1.2/go.mod h1:RT/sEzTbU5y00aCK8UOx6R7YryM0iF1N2MOmC3kKLN4=
 github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
 github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
+github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
+github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
+github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
 go.mongodb.org/mongo-driver v1.13.1 h1:YIc7HTYsKndGK4RFzJ3covLz1byri52x0IoMB0Pt/vk=
 go.mongodb.org/mongo-driver v1.13.1/go.mod h1:wcDf1JBCXy2mOW0bWHwO/IOYqdca1MPCwDtFu/Z9+eo=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
@@ -275,17 +389,43 @@ golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
 golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
 golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20220827204233-334a2380cb91 h1:tnebWN09GYg9OLPss1KXj8txwZc6X6uMr6VFdcGNbHw=
+golang.org/x/exp v0.0.0-20220827204233-334a2380cb91/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
+golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
 golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.15.0 h1:s8pnnxNVzjWyrvYdFUQq5llS1PX2zhPXmccZv99h7uQ=
+golang.org/x/oauth2 v0.15.0/go.mod h1:q48ptWNTY5XWf+JNten23lcvHpLJ0ZSxF5ttTHKVCAM=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
+golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -304,6 +444,7 @@ golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
 golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
@@ -311,15 +452,67 @@ golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
+golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.9.1 h1:8WMNJAz3zrtPmnYC7ISf5dEn3MT0gY7jBJfw27yrrLo=
+golang.org/x/tools v0.9.1/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
+golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
+gonum.org/v1/gonum v0.11.0 h1:f1IJhK4Km5tBJmaiJXtk/PkL4cdVX6J+tGiM187uT5E=
+gonum.org/v1/gonum v0.11.0/go.mod h1:fSG4YDCxxUZQJ7rKsQrj0gMOg00Il0Z96/qMA4bVQhA=
+google.golang.org/api v0.152.0 h1:t0r1vPnfMc260S2Ci+en7kfCZaLOPs5KI0sVV/6jZrY=
+google.golang.org/api v0.152.0/go.mod h1:3qNJX5eOmhiWYc67jRA/3GsDw97UFb5ivv7Y2PrriAY=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
+google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
+google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 h1:wpZ8pe2x1Q3f2KyT5f8oP/fa9rHAKgFPr/HZdNuS+PQ=
+google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:J7XzRzVy1+IPwWHZUzoD0IccYZIrXILAQpc+Qy9CMhY=
+google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17 h1:JpwMPBpFN3uKhdaekDpiNlImDdkUAyiJ6ez/uxGaUSo=
+google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:0xJLfVdJqpAPl8tDg1ujOCGzx6LFLttXT5NhllGOXY4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f h1:ultW7fxlIvee4HYrtnaRPon9HpEgFk5zYpmfMgtKB5I=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f/go.mod h1:L9KNLi232K1/xB6f7AlSX692koaRnKaWSR0stBki0Yc=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
+google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
+google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
+google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=

internal/aws/policy/role-trust-policies.go

@@ -0,0 +1,119 @@
+package policy
+
+import (
+	"encoding/json"
+	"errors"
+	"net/url"
+	"regexp"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/iam/types"
+)
+
+type TrustPolicyDocument struct {
+	Version   string                    `json:"Version"`
+	Statement []RoleTrustStatementEntry `json:"Statement"`
+}
+
+type RoleTrustStatementEntry struct {
+	Sid       string `json:"Sid"`
+	Effect    string `json:"Effect"`
+	Principal struct {
+		AWS       ListOfPrincipals `json:"AWS"`
+		Service   ListOfPrincipals `json:"Service"`
+		Federated ListOfPrincipals `json:"Federated"`
+	} `json:"Principal"`
+	Action    string `json:"Action"`
+	Condition struct {
+		StringEquals struct {
+			StsExternalID                       string           `json:"sts:ExternalId"`
+			SAMLAud                             string           `json:"SAML:aud"`
+			TokenActionsGithubusercontentComSub ListOfPrincipals `json:"token.actions.githubusercontent.com:sub"`
+			TokenActionsGithubusercontentComAud string           `json:"token.actions.githubusercontent.com:aud"`
+			OidcEksSub                          ListOfPrincipals `json:"OidcEksSub"`
+			OidcEksAud                          string           `json:"OidcEksAud"`
+			CognitoAud                          string           `json:"cognito-identity.amazonaws.com:aud"`
+			TerraformAud                        string           `json:"app.terraform.io:aud"` // Terraform Cloud specific
+			TerraformSub                        ListOfPrincipals `json:"app.terraform.io:sub"` // Terraform Cloud specific
+			GCPAud                              string           `json:"accounts.google.com:aud"`
+			GCPSub                              ListOfPrincipals `json:"accounts.google.com:sub"`
+			AzureADIss                          ListOfPrincipals `json:"http://sts.windows.net/tenant-id/iss"` // Azure AD specific
+			AzureADSub                          ListOfPrincipals `json:"sub"`                                  // Common among OIDC providers
+			PingClientId                        string           `json:"pingidentity.com:client_id"`
+			GoogleWorkspaceAud                  string           `json:"workspace.google.com:aud"`
+			GoogleWorkspaceSub                  ListOfPrincipals `json:"workspace.google.com:sub"`
+			CircleCIAud                         ListOfPrincipals `json:"CircleCIAud"`
+			CircleCISub                         ListOfPrincipals `json:"CircleCISub"`
+			// Add other provider-specific claims here
+		} `json:"StringEquals"`
+		StringLike struct {
+			TokenActionsGithubusercontentComSub ListOfPrincipals `json:"token.actions.githubusercontent.com:sub"`
+			TokenActionsGithubusercontentComAud string           `json:"token.actions.githubusercontent.com:aud"`
+			OidcEksSub                          ListOfPrincipals `json:"OidcEksSub"`
+			OidcEksAud                          string           `json:"OidcEksAud"`
+			TerraformAud                        string           `json:"app.terraform.io:aud"` // Terraform Cloud specific
+			TerraformSub                        ListOfPrincipals `json:"app.terraform.io:sub"` // Terraform Cloud specific
+			GCPAud                              string           `json:"accounts.google.com:aud"`
+			GCPSub                              ListOfPrincipals `json:"accounts.google.com:sub"`
+			AzureADIss                          ListOfPrincipals `json:"http://sts.windows.net/tenant-id/iss"` // Azure AD specific
+			AzureADSub                          ListOfPrincipals `json:"sub"`                                  // Common among OIDC providers
+			PingClientId                        string           `json:"pingidentity.com:client_id"`
+			GoogleWorkspaceAud                  string           `json:"workspace.google.com:aud"`
+			GoogleWorkspaceSub                  ListOfPrincipals `json:"workspace.google.com:sub"`
+			CircleCIAud                         ListOfPrincipals `json:"CircleCIAud"`
+			CircleCISub                         ListOfPrincipals `json:"CircleCISub"`
+			// Add patterns for provider-specific claims that support wildcards or partial matches
+		} `json:"StringLike"`
+		ForAnyValueStringLike struct {
+			CognitoAMR string `json:"cognito-identity.amazonaws.com:amr"`
+			//Auth0Amr   ListOfPrincipals `json:"Auth0Amr"`
+			// This section can be extended with any-value-like conditions for other providers if they support such conditions
+		} `json:"ForAnyValue:StringLike"`
+	} `json:"Condition"`
+}
+
+// A custom unmarshaller is necessary because the list of principals can be an array of strings or a string.
+// https://stackoverflow.com/questions/65854778/parsing-arn-from-iam-policy-using-regex
+type ListOfPrincipals []string
+
+func (r *ListOfPrincipals) UnmarshalJSON(b []byte) error {
+	var s string
+	if err := json.Unmarshal(b, &s); err == nil {
+		*r = append(*r, s)
+		return nil
+	}
+	var ss []string
+	if err := json.Unmarshal(b, &ss); err == nil {
+		*r = ss
+		return nil
+	}
+	return errors.New("cannot unmarshal neither to a string nor a slice of strings")
+}
+
+func ParseRoleTrustPolicyDocument(role types.Role) (TrustPolicyDocument, error) {
+	document, _ := url.QueryUnescape(aws.ToString(role.AssumeRolePolicyDocument))
+
+	// These next six lines are a hack, needed because the EKS OIDC json field name is dynamic
+	// and therefore can't be used to unmarshall in a predictable way. The hack involves replacing
+	// the random pattern with a predictable one so that we can add the predictable one in the struct
+	// used to unmarshall.
+	pattern := `(\w+)\:`
+	pattern2 := `".[a-zA-Z0-9\-\.]+/id/`
+	//auth0Pattern := `"auth0.com\:`
+	circleCIPattern := `"oidc.circleci.com/org/[a-zA-Z0-9\-]+:`
+	var reEKSSub = regexp.MustCompile(pattern2 + pattern + "sub")
+	var reEKSAud = regexp.MustCompile(pattern2 + pattern + "aud")
+	//var reAuth0Sub = regexp.MustCompile(auth0Pattern + "amr")
+	var reCircleCIAud = regexp.MustCompile(circleCIPattern + "aud")
+	var reCircleCISSub = regexp.MustCompile(circleCIPattern + "sub")
+
+	document = reEKSSub.ReplaceAllString(document, "\"OidcEksSub")
+	document = reEKSAud.ReplaceAllString(document, "\"OidcEksAud")
+	//document = reAuth0Sub.ReplaceAllString(document, "\"Auth0Amr")
+	document = reCircleCIAud.ReplaceAllString(document, "\"CircleCIAud")
+	document = reCircleCISSub.ReplaceAllString(document, "\"CircleCISub")
+
+	var parsedDocumentToJSON TrustPolicyDocument
+	_ = json.Unmarshal([]byte(document), &parsedDocumentToJSON)
+	return parsedDocumentToJSON, nil
+}

internal/log.go

@@ -1,6 +1,7 @@
 package internal
 
 import (
+	"fmt"
 	"log"
 	"os"
 	"os/user"
@@ -8,7 +9,10 @@ import (
 
 	"github.com/BishopFox/cloudfox/globals"
 	"github.com/aws/smithy-go/ptr"
+	"github.com/fatih/color"
 	"github.com/jedib0t/go-pretty/text"
+	"github.com/kyokomi/emoji"
+	"github.com/sirupsen/logrus"
 )
 
 func init() {
@@ -30,3 +34,54 @@ func GetLogDirPath() *string {
 	}
 	return ptr.String(dir)
 }
+
+type Logger struct {
+	version string
+	txtLog  *logrus.Logger
+}
+
+func NewLogger() Logger {
+	var logger = Logger{
+		version: globals.CLOUDFOX_VERSION,
+		txtLog:  TxtLog,
+	}
+	return logger
+}
+
+func (l *Logger) Info(text string) {
+	l.InfoM(text, "config")
+}
+
+func (l *Logger) InfoM(text string, module string) {
+	var cyan = color.New(color.FgCyan).SprintFunc()
+	fmt.Printf("[%s][%s] %s\n", cyan(emoji.Sprintf(":fox:cloudfox %s :fox:", l.version)), cyan(module), text)
+}
+
+func (l *Logger) Success(text string) {
+	l.SuccessM(text, "config")
+}
+func (l *Logger) SuccessM(text string, module string) {
+	var green = color.New(color.FgGreen).SprintFunc()
+	fmt.Printf("[%s][%s] %s\n", green(emoji.Sprintf(":fox:cloudfox %s :fox:", l.version)), green(module), text)
+}
+
+func (l *Logger) Error(text string) {
+	l.ErrorM(text, "config")
+}
+
+func (l *Logger) ErrorM(text string, module string) {
+	var red = color.New(color.FgRed).SprintFunc()
+	fmt.Printf("[%s][%s] %s\n", red(emoji.Sprintf(":fox:cloudfox %s :fox:", l.version)), red(module), text)
+	l.txtLog.Printf("[%s] %s", module, text)
+}
+
+func (l *Logger) Fatal(text string) {
+	l.FatalM(text, "config")
+}
+
+func (l *Logger) FatalM(text string, module string) {
+	var red = color.New(color.FgRed).SprintFunc()
+	l.txtLog.Printf("[%s] %s", module, text)
+	fmt.Printf("[%s][%s] %s\n", red(emoji.Sprintf(":fox:cloudfox %s :fox:", l.version)), red(module), text)
+	os.Exit(1)
+}

internal/output2.go

@@ -7,6 +7,7 @@ import (
 	"log"
 	"os"
 	"path"
+	"path/filepath"
 	"regexp"
 	"strings"
 
@@ -59,6 +60,49 @@ type LootFile struct {
 	Contents    string
 }
 
+// TODO support datastructures that enable brief or wide format
+type CloudfoxOutput interface {
+	TableFiles() []TableFile
+	LootFiles() []LootFile
+}
+
+// HandleOutput dynamically handles the output based on the provided arguments.
+// TODO support brief of wide
+func HandleOutput(
+	cloudProvider string,
+	format string,
+	outputDirectory string,
+	verbosity int,
+	wrap bool,
+	baseCloudfoxModule string,
+	principal string,
+	resultsIdentifier string,
+	dataToOutput CloudfoxOutput,
+) error {
+	// Update OutputClient fields based on arguments
+	outDirectoryPath := filepath.Join(outputDirectory, "cloudfox-output", cloudProvider, fmt.Sprintf("%s-%s", principal, resultsIdentifier), baseCloudfoxModule)
+	tables := dataToOutput.TableFiles()
+	lootFiles := dataToOutput.LootFiles()
+
+	outputClient := OutputClient{
+		Verbosity:     verbosity,
+		CallingModule: baseCloudfoxModule,
+		Table: TableClient{
+			Wrap:          wrap,
+			DirectoryName: outDirectoryPath,
+			TableFiles:    tables,
+		},
+		Loot: LootClient{
+			DirectoryName: outDirectoryPath,
+			LootFiles:     lootFiles,
+		},
+	}
+
+	// Handle output based on the verbosity level
+	outputClient.WriteFullOutput(tables, lootFiles)
+	return nil
+}
+
 func removeColorCodes(input string) string {
 	// Regular expression to match ANSI color codes
 	ansiRegExp := regexp.MustCompile(`\x1b\[[0-9;]*m`)
@@ -97,7 +141,7 @@ func removeColorCodesFromNestedSlice(input [][]string) [][]string {
 }
 
 func (o *OutputClient) WriteFullOutput(tables []TableFile, lootFiles []LootFile) {
-
+	logger := NewLogger()
 	switch o.Verbosity {
 	case 2:
 		o.Table.printTablesToScreen(tables)
@@ -127,7 +171,8 @@ func (o *OutputClient) WriteFullOutput(tables []TableFile, lootFiles []LootFile)
 	}
 
 	for _, path := range outputPaths {
-		fmt.Printf("[%s][%s] Output written to %s\n", cyan(o.CallingModule), cyan(o.PrefixIdentifier), path)
+		logger.InfoM(fmt.Sprintf("Output written to %s", path), o.CallingModule)
+		// fmt.Printf("[%s][%s] Output written to %s\n", cyan(o.CallingModule), cyan(o.PrefixIdentifier), path)
 	}
 }
 

main.go

@@ -10,11 +10,11 @@ import (
 var (
 	rootCmd = &cobra.Command{
 		Use:     os.Args[0],
-		Version: "1.13.1-prerelease",
+		Version: "1.14.0-prerelease",
 	}
 )
 
 func main() {
-	rootCmd.AddCommand(cli.AWSCommands, cli.AzCommands)
+	rootCmd.AddCommand(cli.AWSCommands, cli.AzCommands, cli.GCPCommands)
 	rootCmd.Execute()
 }