Security Recommendations
Project-scoped GCP security posture: IAM least-privilege recommendations (Recommender API) plus service-account key hygiene — user-managed keys and disabled accounts.
Same idea on another cloud
What this pane shows
The security posture LightPane can read within a read-only project viewer, grouped by severity (CRITICAL / HIGH / MEDIUM / LOW) and category, with the description and remediation in the drawer:
- IAM recommendations — least-privilege suggestions from GCP's Recommender (roles that can be removed or replaced because the identity never uses them).
- Service-account key hygiene — service accounts holding user-managed keys (long-lived credentials that don't auto-rotate — GCP's most common credential-leak vector), flagged by age, plus disabled-but-present accounts.
This is the GCP counterpart to the AWS and Azure Security Findings panes. Note that GCP's Security Command Center — the organization-wide misconfiguration, vulnerability and threat feed — is org-scoped and needs the Premium/Enterprise tier, so it is not part of this project-scoped view; it is tracked for a later phase.
Key use cases
- Trim over-privileged identities down to least privilege.
- Find service accounts still using long-lived user-managed keys and rotate them onto Workload Identity Federation or short-lived credentials.
- Spot disabled service accounts that were never cleaned up.
- Review project IAM posture alongside the AWS and Azure security panes.
How to embed
lp.js is the single-entry loader: it injects the shared LightPane runtime
(and sd-embed.css) once per page. Add this pane's own stylesheet and script;
the pane mounts itself wherever the matching <div> is in the DOM.
<!-- In <head> — this pane's stylesheet -->
<link rel="stylesheet" href="https://lightpane.io/_pane-tests/gcp/security-findings/security-findings.css">
<!-- Your access key (inline, or set window.lpEmbed.accessKey from your own JS) -->
<script>window.lpEmbed = { accessKey: "<your-access-key>" };</script>
<!-- Where the pane should appear -->
<div class="lp-gcp-security-findings-panel" data-lp-account="<your-account-alias>"></div>
<!-- Before </body> — shared loader + this pane's script -->
<script src="https://lightpane.io/embed/lp.js"></script>
<script src="https://lightpane.io/_pane-tests/gcp/security-findings/security-findings.js" defer></script>
Tier
Available on Builder and above.
Build notes
Live-wired to gcp_recommender_iam_policy (IAM Policy Recommender) and
gcp_iam_service_accounts (user-managed-key hygiene), both project-scoped.
Security Command Center (org-scoped, Premium-tier) is a post-launch item.