stackql/StackQL Cloud Audit
Audit GCP, AWS, and Azure live with SQL — public firewalls, public IPs, weak storage/SQL configs, and more. No agents, no pipelines. A provider runs only when its credentials are supplied.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| gcp-project-id | GCP project ID to audit (substituted as ${PROJECT_ID} in google checks). | no | "" |
| gcp-credentials | Full contents of a GCP service account JSON key. Pass via a workflow secret, e.g. secrets.GCP_SA_JSON. | no | "" |
| google-provider-version | Version of the Google provider to pull (blank = v25.12.00357). | no | v25.12.00357 |
| aws-access-key-id | AWS access key ID. | no | "" |
| aws-secret-access-key | AWS secret access key. Pass via a workflow secret. | no | "" |
| aws-region | AWS region to audit (substituted as ${AWS_REGION} in aws checks). | no | "" |
| aws-provider-version | Version of the AWS provider to pull (blank = v26.05.00395). | no | v26.05.00395 |
| azure-subscription-id | Azure subscription ID to audit (substituted as ${SUBSCRIPTION_ID} in azure checks). | no | "" |
| azure-tenant-id | Azure AD tenant ID (for service-principal auth). | no | "" |
| azure-client-id | Azure AD application (client) ID. | no | "" |
| azure-client-secret | Azure AD client secret. Pass via a workflow secret. | no | "" |
| azure-provider-version | Version of the Azure provider to pull (blank = v24.10.00267). | no | v24.10.00267 |
| entra-id-provider-version | Version of the entra_id provider to pull (blank = v26.06.00405). | no | v26.06.00405 |
| queries-path | Path to a custom queries directory (must contain per-provider subdirs: google/ aws/ azure/). | no | "" |
| fail-on-severity | Fail the workflow if any finding is at or above this severity (CRITICAL, HIGH, MEDIUM, LOW). Use NONE to never fail. | no | HIGH |
| stackql-version | stackql release to install (e.g. "v0.5.745") or "latest" | no | latest |
| upload-logs | Upload the per-invocation .log files (stackql-audit-logs) and the per-provider JSONL data streams (stackql-audit-data-streams) as workflow artifacts. Useful for debugging empty/odd results. | no | false |
| merge-data-streams | Merge all *-findings.jsonl into one summary.json (keyed by provider) at the end. Blank = on whenever upload-logs is true; set "true"/"false" to force. | no | "" |
| log-retention-days | Retention in days for the uploaded artifacts (0 = repository default). Integer in [0, 90]. Only used when upload-logs is true. | no | 0 |
Outputs
| name | description |
|---|---|
| findings-count | Total findings across all checks |
| highest-severity | Highest severity finding (CRITICAL/HIGH/MEDIUM/LOW/NONE) |