Add --adc (Application Default Credentials) authentication mode for GCP provider
Author: TheAshwanikCreated Jun 22, 2026Updated Jun 22, 2026
Feature Request
Add a new --adc (Application Default Credentials) authentication mode to ScoutSuite's GCP provider.
Motivation
When ScoutSuite runs inside GCP (on GCE VMs, Cloud Run services, or GKE pods), the instance's attached service account provides short-lived, auto-refreshed credentials via the GCP metadata server. Using these avoids the security anti-pattern of creating and distributing long-lived JSON key files.
Proposed Change
- Add
--adcflag to the GCP CLI argument parser (mutually exclusive with -u and -s) - Implement ADC authentication branch in
GCPAuthenticationStrategycallinggoogle.auth.default()without setting GOOGLE_APPLICATION_CREDENTIALS - Wire dc parameter through__main__.pycall chain - Add unit and property-based tests
Backward Compatibility
All existing -u and -s behaviour is preserved without modification.
Source: nccgroup/ScoutSuite