feat(gcp-security): new Google Cloud cloud-containment integration

Compute Engine + Security Command Center, 7 commands: list/create/delete VPC
firewall rules (deny to isolate), list/stop instances, list SCC findings.
Service-account RS256 JWT auth (remote engine, PyJWT + cryptography).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

integrations/gcp-security/manifest.yaml

@@ -0,0 +1,97 @@
+id: gcp_security
+name: Google Cloud
+version: 1.0.0
+description: "Google Cloud Platform (Compute Engine + Security Command Center) — cloud containment: list/create/delete VPC firewall rules (deny to isolate), list and stop Compute Engine instances, and list Security Command Center findings. Authenticates with a Google service account (RS256 JWT bearer flow). Runs on a remote engine. Requires the Python 'PyJWT' and 'cryptography' libraries on the engine host (pip install pyjwt cryptography)."
+changelog: "1.0.0 — Initial release: list/create/delete firewall rules, list/stop instances, list Security Command Center findings."
+category: cloud
+
+# Per-instance configuration. The scripts build a signed RS256 assertion from the
+# service account's private_key/client_email and exchange it for an access token
+# (scope cloud-platform). The service account needs Compute and Security Center
+# roles. organization_id is only used by gcp-list-scc-findings.
+config_schema:
+  properties:
+    service_account_json:
+      type: string
+      description: "Full service account key JSON (must contain client_email and private_key)"
+      x-soar-sensitive: true
+    project_id:
+      type: string
+      description: "GCP project ID"
+    organization_id:
+      type: string
+      description: "GCP organization ID (only required for Security Command Center findings)"
+  required:
+    - service_account_json
+    - project_id
+
+commands:
+  - id: list_firewalls
+    name: gcp-list-firewalls
+    description: "List VPC firewall rules in the project."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }
+  - id: create_firewall
+    name: gcp-create-firewall
+    description: "Create a VPC firewall rule (e.g. a deny rule to isolate targets)."
+    inputs_schema:
+      properties:
+        name: { type: string, description: "Firewall rule name" }
+        network: { type: string, description: "Network name (default 'default')" }
+        direction: { type: string, description: "INGRESS or EGRESS (default INGRESS)" }
+        action: { type: string, description: "allow or deny (default deny)" }
+        protocol: { type: string, description: "Protocol (tcp, udp, all — default all)" }
+        ports: { type: string, description: "Comma-separated ports (optional; omit for all)" }
+        ranges: { type: string, description: "Comma-separated source/destination CIDR ranges (default 0.0.0.0/0)" }
+        priority: { type: number, description: "Rule priority 0-65535 (default 1000)" }
+        target_tags: { type: string, description: "Comma-separated target network tags (optional)" }
+      required: [name]
+    outputs_schema: { properties: {} }
+  - id: delete_firewall
+    name: gcp-delete-firewall
+    description: "Delete a VPC firewall rule by name."
+    inputs_schema:
+      properties:
+        name: { type: string, description: "Firewall rule name" }
+      required: [name]
+    outputs_schema: { properties: {} }
+  - id: list_instances
+    name: gcp-list-instances
+    description: "List Compute Engine instances in a zone."
+    risk: read
+    inputs_schema:
+      properties:
+        zone: { type: string, description: "Zone (e.g. europe-west1-b)" }
+      required: [zone]
+    outputs_schema: { properties: {} }
+  - id: stop_instance
+    name: gcp-stop-instance
+    description: "Stop a Compute Engine instance (containment)."
+    inputs_schema:
+      properties:
+        zone: { type: string, description: "Zone of the instance" }
+        instance: { type: string, description: "Instance name" }
+      required: [zone, instance]
+    outputs_schema: { properties: {} }
+  - id: list_scc_findings
+    name: gcp-list-scc-findings
+    description: "List Security Command Center findings for the organization."
+    risk: read
+    inputs_schema:
+      properties:
+        filter: { type: string, description: "Optional SCC filter (e.g. state=\"ACTIVE\")" }
+        page_size: { type: number, description: "Max findings (default 100)" }
+      required: []
+    outputs_schema: { properties: {} }
+
+  - id: test_connection
+    name: gcp-test-connection
+    description: "Verify the service-account token exchange and project access (used by the Test button)."
+    risk: read
+    inputs_schema:
+      properties: {}
+      required: []
+    outputs_schema: { properties: {} }

integrations/gcp-security/scripts/create_firewall.py

@@ -0,0 +1,118 @@
+import json, os, sys, time, urllib.parse, urllib.request, urllib.error
+
+import jwt
+
+TOKEN_URL = "https://oauth2.googleapis.com/token"
+SCOPE = "https://www.googleapis.com/auth/cloud-platform"
+COMPUTE = "https://compute.googleapis.com/compute/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _token(cfg):
+    raw = cfg.get("service_account_json", "")
+    sa = json.loads(raw) if isinstance(raw, str) else raw
+    if not sa.get("client_email") or not sa.get("private_key"):
+        raise Exception("service_account_json must contain client_email and private_key")
+    now = int(time.time())
+    aud = sa.get("token_uri") or TOKEN_URL
+    payload = {
+        "iss": sa["client_email"],
+        "scope": SCOPE,
+        "aud": aud,
+        "iat": now,
+        "exp": now + 3600,
+    }
+    assertion = jwt.encode(payload, sa["private_key"], algorithm="RS256")
+    data = urllib.parse.urlencode({
+        "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
+        "assertion": assertion,
+    }).encode("utf-8")
+    req = urllib.request.Request(aud, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded"}, method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def api(method, url, cfg, body=None, params=None):
+    q = {k: str(v) for k, v in (params or {}).items() if v not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + _token(cfg)}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+proj = lambda cfg: str(cfg.get("project_id", ""))
+
+
+def _csv(v):
+    return [s.strip() for s in str(v).split(",") if s.strip()]
+
+
+def main(cfg, inputs):
+    name = inputs.get("name")
+    if not name:
+        raise Exception("name is required")
+    network = inputs.get("network") or "default"
+    direction = inputs.get("direction") or "INGRESS"
+    action = inputs.get("action") or "deny"
+    protocol = inputs.get("protocol") or "all"
+    ports = _csv(inputs.get("ports", ""))
+    ranges = _csv(inputs.get("ranges", ""))
+    priority = inputs.get("priority", 1000)
+    target_tags = _csv(inputs.get("target_tags", ""))
+
+    rule_entry = {"IPProtocol": protocol or "all"}
+    if ports:
+        rule_entry["ports"] = ports
+
+    key = "allowed" if action == "allow" else "denied"
+
+    body = {
+        "name": name,
+        "network": "global/networks/" + (network or "default"),
+        "direction": direction or "INGRESS",
+        "priority": int(priority),
+        key: [rule_entry],
+    }
+
+    ranges_list = ranges or ["0.0.0.0/0"]
+    if (direction or "INGRESS") == "EGRESS":
+        body["destinationRanges"] = ranges_list
+    else:
+        body["sourceRanges"] = ranges_list
+
+    if target_tags:
+        body["targetTags"] = target_tags
+
+    url = COMPUTE + "/projects/{}/global/firewalls".format(proj(cfg))
+    return api("POST", url, cfg, body=body)
+
+
+_run(main)

integrations/gcp-security/scripts/delete_firewall.py

@@ -0,0 +1,83 @@
+import json, os, sys, time, urllib.parse, urllib.request, urllib.error
+
+import jwt
+
+TOKEN_URL = "https://oauth2.googleapis.com/token"
+SCOPE = "https://www.googleapis.com/auth/cloud-platform"
+COMPUTE = "https://compute.googleapis.com/compute/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _token(cfg):
+    raw = cfg.get("service_account_json", "")
+    sa = json.loads(raw) if isinstance(raw, str) else raw
+    if not sa.get("client_email") or not sa.get("private_key"):
+        raise Exception("service_account_json must contain client_email and private_key")
+    now = int(time.time())
+    aud = sa.get("token_uri") or TOKEN_URL
+    payload = {
+        "iss": sa["client_email"],
+        "scope": SCOPE,
+        "aud": aud,
+        "iat": now,
+        "exp": now + 3600,
+    }
+    assertion = jwt.encode(payload, sa["private_key"], algorithm="RS256")
+    data = urllib.parse.urlencode({
+        "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
+        "assertion": assertion,
+    }).encode("utf-8")
+    req = urllib.request.Request(aud, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded"}, method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def api(method, url, cfg, body=None, params=None):
+    q = {k: str(v) for k, v in (params or {}).items() if v not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + _token(cfg)}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+proj = lambda cfg: str(cfg.get("project_id", ""))
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main(cfg, inputs):
+    name = inputs.get("name")
+    if not name:
+        raise Exception("name is required")
+    url = COMPUTE + "/projects/{}/global/firewalls/{}".format(proj(cfg), q(name))
+    return api("DELETE", url, cfg)
+
+
+_run(main)

integrations/gcp-security/scripts/list_firewalls.py

@@ -0,0 +1,79 @@
+import json, os, sys, time, urllib.parse, urllib.request, urllib.error
+
+import jwt
+
+TOKEN_URL = "https://oauth2.googleapis.com/token"
+SCOPE = "https://www.googleapis.com/auth/cloud-platform"
+COMPUTE = "https://compute.googleapis.com/compute/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _token(cfg):
+    raw = cfg.get("service_account_json", "")
+    sa = json.loads(raw) if isinstance(raw, str) else raw
+    if not sa.get("client_email") or not sa.get("private_key"):
+        raise Exception("service_account_json must contain client_email and private_key")
+    now = int(time.time())
+    aud = sa.get("token_uri") or TOKEN_URL
+    payload = {
+        "iss": sa["client_email"],
+        "scope": SCOPE,
+        "aud": aud,
+        "iat": now,
+        "exp": now + 3600,
+    }
+    assertion = jwt.encode(payload, sa["private_key"], algorithm="RS256")
+    data = urllib.parse.urlencode({
+        "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
+        "assertion": assertion,
+    }).encode("utf-8")
+    req = urllib.request.Request(aud, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded"}, method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def api(method, url, cfg, body=None, params=None):
+    q = {k: str(v) for k, v in (params or {}).items() if v not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + _token(cfg)}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+proj = lambda cfg: str(cfg.get("project_id", ""))
+
+
+def main(cfg, inputs):
+    url = COMPUTE + "/projects/{}/global/firewalls".format(proj(cfg))
+    return api("GET", url, cfg)
+
+
+_run(main)

integrations/gcp-security/scripts/list_instances.py

@@ -0,0 +1,83 @@
+import json, os, sys, time, urllib.parse, urllib.request, urllib.error
+
+import jwt
+
+TOKEN_URL = "https://oauth2.googleapis.com/token"
+SCOPE = "https://www.googleapis.com/auth/cloud-platform"
+COMPUTE = "https://compute.googleapis.com/compute/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _token(cfg):
+    raw = cfg.get("service_account_json", "")
+    sa = json.loads(raw) if isinstance(raw, str) else raw
+    if not sa.get("client_email") or not sa.get("private_key"):
+        raise Exception("service_account_json must contain client_email and private_key")
+    now = int(time.time())
+    aud = sa.get("token_uri") or TOKEN_URL
+    payload = {
+        "iss": sa["client_email"],
+        "scope": SCOPE,
+        "aud": aud,
+        "iat": now,
+        "exp": now + 3600,
+    }
+    assertion = jwt.encode(payload, sa["private_key"], algorithm="RS256")
+    data = urllib.parse.urlencode({
+        "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
+        "assertion": assertion,
+    }).encode("utf-8")
+    req = urllib.request.Request(aud, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded"}, method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def api(method, url, cfg, body=None, params=None):
+    q = {k: str(v) for k, v in (params or {}).items() if v not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + _token(cfg)}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+proj = lambda cfg: str(cfg.get("project_id", ""))
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main(cfg, inputs):
+    zone = inputs.get("zone")
+    if not zone:
+        raise Exception("zone is required")
+    url = COMPUTE + "/projects/{}/zones/{}/instances".format(proj(cfg), q(zone))
+    return api("GET", url, cfg)
+
+
+_run(main)

integrations/gcp-security/scripts/list_scc_findings.py

@@ -0,0 +1,81 @@
+import json, os, sys, time, urllib.parse, urllib.request, urllib.error
+
+import jwt
+
+TOKEN_URL = "https://oauth2.googleapis.com/token"
+SCOPE = "https://www.googleapis.com/auth/cloud-platform"
+COMPUTE = "https://compute.googleapis.com/compute/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _token(cfg):
+    raw = cfg.get("service_account_json", "")
+    sa = json.loads(raw) if isinstance(raw, str) else raw
+    if not sa.get("client_email") or not sa.get("private_key"):
+        raise Exception("service_account_json must contain client_email and private_key")
+    now = int(time.time())
+    aud = sa.get("token_uri") or TOKEN_URL
+    payload = {
+        "iss": sa["client_email"],
+        "scope": SCOPE,
+        "aud": aud,
+        "iat": now,
+        "exp": now + 3600,
+    }
+    assertion = jwt.encode(payload, sa["private_key"], algorithm="RS256")
+    data = urllib.parse.urlencode({
+        "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
+        "assertion": assertion,
+    }).encode("utf-8")
+    req = urllib.request.Request(aud, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded"}, method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def api(method, url, cfg, body=None, params=None):
+    q = {k: str(v) for k, v in (params or {}).items() if v not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + _token(cfg)}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main(cfg, inputs):
+    org = cfg.get("organization_id")
+    if not org:
+        raise Exception("organization_id must be configured for SCC findings")
+    filter_ = inputs.get("filter")
+    page_size = inputs.get("page_size", 100)
+    url = "https://securitycenter.googleapis.com/v1/organizations/" + str(org) + "/sources/-/findings"
+    return api("GET", url, cfg, params={"filter": filter_, "pageSize": int(page_size)})
+
+
+_run(main)

integrations/gcp-security/scripts/stop_instance.py

@@ -0,0 +1,86 @@
+import json, os, sys, time, urllib.parse, urllib.request, urllib.error
+
+import jwt
+
+TOKEN_URL = "https://oauth2.googleapis.com/token"
+SCOPE = "https://www.googleapis.com/auth/cloud-platform"
+COMPUTE = "https://compute.googleapis.com/compute/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _token(cfg):
+    raw = cfg.get("service_account_json", "")
+    sa = json.loads(raw) if isinstance(raw, str) else raw
+    if not sa.get("client_email") or not sa.get("private_key"):
+        raise Exception("service_account_json must contain client_email and private_key")
+    now = int(time.time())
+    aud = sa.get("token_uri") or TOKEN_URL
+    payload = {
+        "iss": sa["client_email"],
+        "scope": SCOPE,
+        "aud": aud,
+        "iat": now,
+        "exp": now + 3600,
+    }
+    assertion = jwt.encode(payload, sa["private_key"], algorithm="RS256")
+    data = urllib.parse.urlencode({
+        "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
+        "assertion": assertion,
+    }).encode("utf-8")
+    req = urllib.request.Request(aud, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded"}, method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def api(method, url, cfg, body=None, params=None):
+    q = {k: str(v) for k, v in (params or {}).items() if v not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + _token(cfg)}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+proj = lambda cfg: str(cfg.get("project_id", ""))
+q = lambda v: urllib.parse.quote(str(v), safe="")
+
+
+def main(cfg, inputs):
+    zone = inputs.get("zone")
+    if not zone:
+        raise Exception("zone is required")
+    instance = inputs.get("instance")
+    if not instance:
+        raise Exception("instance is required")
+    url = COMPUTE + "/projects/{}/zones/{}/instances/{}/stop".format(proj(cfg), q(zone), q(instance))
+    return api("POST", url, cfg)
+
+
+_run(main)

integrations/gcp-security/scripts/test_connection.py

@@ -0,0 +1,80 @@
+import json, os, sys, time, urllib.parse, urllib.request, urllib.error
+
+import jwt
+
+TOKEN_URL = "https://oauth2.googleapis.com/token"
+SCOPE = "https://www.googleapis.com/auth/cloud-platform"
+COMPUTE = "https://compute.googleapis.com/compute/v1"
+
+
+def _cfg():
+    return json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
+
+
+def _inputs():
+    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
+
+
+def _token(cfg):
+    raw = cfg.get("service_account_json", "")
+    sa = json.loads(raw) if isinstance(raw, str) else raw
+    if not sa.get("client_email") or not sa.get("private_key"):
+        raise Exception("service_account_json must contain client_email and private_key")
+    now = int(time.time())
+    aud = sa.get("token_uri") or TOKEN_URL
+    payload = {
+        "iss": sa["client_email"],
+        "scope": SCOPE,
+        "aud": aud,
+        "iat": now,
+        "exp": now + 3600,
+    }
+    assertion = jwt.encode(payload, sa["private_key"], algorithm="RS256")
+    data = urllib.parse.urlencode({
+        "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
+        "assertion": assertion,
+    }).encode("utf-8")
+    req = urllib.request.Request(aud, data=data,
+                                 headers={"Content-Type": "application/x-www-form-urlencoded"}, method="POST")
+    with urllib.request.urlopen(req, timeout=60) as r:
+        tok = json.loads(r.read())
+    if not tok.get("access_token"):
+        raise Exception("Token request failed: " + json.dumps(tok))
+    return tok["access_token"]
+
+
+def api(method, url, cfg, body=None, params=None):
+    q = {k: str(v) for k, v in (params or {}).items() if v not in (None, "")}
+    if q:
+        url += ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    headers = {"Accept": "application/json", "Authorization": "Bearer " + _token(cfg)}
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    req = urllib.request.Request(url, data=data, headers=headers, method=method)
+    with urllib.request.urlopen(req, timeout=90) as r:
+        raw = r.read()
+        return json.loads(raw) if raw else {}
+
+
+def _run(fn):
+    try:
+        print(json.dumps(fn(_cfg(), _inputs())))
+    except urllib.error.HTTPError as e:
+        print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
+        sys.exit(1)
+    except Exception as e:
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+proj = lambda cfg: str(cfg.get("project_id", ""))
+
+
+def main(cfg, inputs):
+    url = COMPUTE + "/projects/{}".format(proj(cfg))
+    api("GET", url, cfg)
+    return {"ok": True}
+
+
+_run(main)