#1732·ScoutSuite

Add --adc (Application Default Credentials) authentication mode for GCP provider

Author: TheAshwanikCreated Jun 22, 2026Updated Jun 22, 2026

Feature Request

Add a new --adc (Application Default Credentials) authentication mode to ScoutSuite's GCP provider.

Motivation

When ScoutSuite runs inside GCP (on GCE VMs, Cloud Run services, or GKE pods), the instance's attached service account provides short-lived, auto-refreshed credentials via the GCP metadata server. Using these avoids the security anti-pattern of creating and distributing long-lived JSON key files.

Proposed Change

  • Add --adc flag to the GCP CLI argument parser (mutually exclusive with -u and -s)
  • Implement ADC authentication branch in GCPAuthenticationStrategy calling google.auth.default() without setting GOOGLE_APPLICATION_CREDENTIALS - Wire dc parameter through __main__.py call chain
  • Add unit and property-based tests

Backward Compatibility

All existing -u and -s behaviour is preserved without modification.