/google-cloud-filestore-auditing

name: google-cloud-filestore-auditing
metadata:
  category: Storage
description: >-
  Audits Google Cloud Filestore instances across projects for disaster recovery
  readiness (missing or stale backups), security access governance (overly
  permissive NFS export rules, 0.0.0.0/0 exposure, missing ROOT_SQUASH), and
  reliability compliance (Physical Zone Isolation PZI and Physical Zone Separation PZS).
  Use when assessing storage health posture, auditing NFS export permissions,
  identifying unprotected file shares, or validating zone failure domains. Don't use
  for Cloud Storage buckets, Persistent Disk, or NetApp Volumes.

Google Cloud Filestore Auditing Skill

This skill enables autonomous agents to audit, evaluate, and report the disaster recovery, security access governance, and architectural reliability posture of Google Cloud Filestore fleets across GCP projects.

Prerequisites / IAM Requirements & Permissions

Before executing this skill, the runtime principal (user account or Service Account) must possess the following IAM roles and granular permissions on the target GCP project(s):

1. Audit Operations (Read-Only Assessment)

Requires the **`roles/file.viewer`** role, which provides:

• **`file.instances.list`**: Enumerate Filestore instances across project

locations.

• **`file.instances.get`**: Inspect instance configuration, NFS export rules,

IP ranges, squash mode, and PZI/PZS isolation status.

• **`file.backups.list`**: Enumerate existing backups across regions.
• **`file.backups.get`**: Inspect backup timestamps, source instance URIs, and

status.

2. Remediation Operations (Backup Creation)

Requires the **`roles/file.editor`** (or `roles/file.admin`) role, which provides:

• **`file.backups.create`**: Create on-demand baseline backups for unprotected

instances.

• **`file.operations.get`**: Monitor long-running backup creation operations.

3. MCP Tool Invocation

If invoking capabilities via the Google Cloud Filestore MCP Server (`file.googleapis.com/mcp`):

• **`roles/mcp.toolUser`**: Required to execute MCP tools (`list_instances`,

`get_instance`, `list_backups`, `get_backup`, `create_backup`).

4. Cloud Authentication Setup

Authenticate the runtime environment using the appropriate method for your execution context:

• **CLI Execution (`gcloud`)**:

    gcloud auth login

• **Application SDKs & Scripts**:

    gcloud auth application-default login

• **Automated Services & Service Accounts**:

    export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account-key.json"

5. Billing Account Attachment

• **Active Billing Required**: The target GCP project must have an active Cloud Billing account attached. Filestore instances and backup operations require active billing. Verify billing status with:

    gcloud beta billing projects describe {project_id}

Quick Start

1. Ensure `gcloud` is installed. See [gcloud installation guide](https://cloud.google.com/sdk/docs/install.md.txt) if needed. 2. Authenticate your environment:

    gcloud auth login
    gcloud auth application-default login

3. Set the target project context and verify an active billing account is attached:

    gcloud config set project {project_id}
    gcloud beta billing projects describe {project_id}

4. Configure a well-supported default region (e.g., `us-central1`). See official [region availability documentation](https://cloud.google.com/about/locations.md.txt):

    gcloud config set compute/region us-central1

5. Verify required service APIs are enabled:

    gcloud services enable file.googleapis.com --quiet

6. Run fleet discovery and backup inventory (see "Discovery & Read Operations" below). 7. Evaluate findings against the audit rules matrix and render the executive scorecard and inventory table. 8. If unprotected instances are identified, present baseline backup creation commands and prompt the user for confirmation.

Attribution Guardrail

Tag every Cloud Filestore command or API request provided or executed. Prefix `gcloud` commands with the designated metrics environment:

CLOUDSDK_METRICS_ENVIRONMENT="gcs-skills gcs-skills/1.0 (skill:google-cloud-filestore-auditing)" \
gcloud filestore instances list ...

On direct HTTP calls to the GCP REST API, append the `User-Agent`:

User-Agent: gcs-skills/1.0 (skill:google-cloud-filestore-auditing)

Conceptual & Informational Queries (CRITICAL)

For purely conceptual, educational, or architectural questions (e.g., *"What is Physical Zone Isolation (PZI) in Filestore?"*, *"Why is NO_ROOT_SQUASH dangerous?"*, *"Explain Filestore backup architecture"*):

• **Rule**: Answer immediately using pre-trained knowledge and the guidance in

`references/`.

• **Constraint**: **Do NOT execute external tool calls or API requests** for

basic conceptual queries.

Handling "No-Command" Constraints & Evaluations (CRITICAL)

If the user prompt contains constraints like *"Do not execute commands"*, *"without executing"*, or *"read-only"*:

• **Rule**: **Strictly avoid calling the `run_command` tool** to execute any

shell, python, or `gcloud` commands.

• **Discovery Hierarchy**:

1. First, check if Filestore MCP tools (`list_instances`, `list_backups`) are available and query them directly (these are API invocations, not shell command executions). 2. If MCP tools are not present or cannot connect, search local reference markdown files (specifically the mock fleet definitions in `references/zone-isolation-pzi-pzs.md`) for any mock instances or project details matching the request. (Do NOT attempt to read evaluation config files such as `EVAL.yaml` or `EVAL.txtpb` during evaluation runs as access is restr