In the past six months, there have been two high-profile cases of companies storing sensitive data on cloud servers that were inadvertently exposed to the outside world. Google LLC is looking to help customers of its infrastructure as a service platform avoid making the same mistake.

The technology giant today open-sourced Forseti Security, a toolkit for protecting Google Cloud Platform deployments. It’s the fruit of a collaboration with Spotify AB, which became a GCP customer last year. An official blog post recounts how the music streaming provider had separately embarked on a project to enhance the platform’s controls and took the opportunity to work together with Google toward their common goal.

Forseti extends the native security features of GCP with four integrated tools. The first is referred to as Inventory and, as the name suggests, it enables companies to produce a record of the resources in a cloud deployment.

Specifically, the tool collects information about the access restrictions that apply to each resource. The snapshots created with Inventory can be used to form an audit log for showing how permissions change over time. More importantly, the data helps power the three other components that make up Forseti.

At the top of the list is Scanner, which can check cloud resources against a company’s access policies to identify violations. It’s paired with a remediation tool called Enforcer that automatically removes unnecessary permissions. This would include, among other things, any settings that allow a cloud server containing sensitive data to be accessed via the public web.

Completing the lineup is Explain. It’s a diagnostics tool that can shed light on how much access users have to a cloud deployment as well reveal areas for improvement. According to Google, it could come handy not only for the administrators who manage an environment but also auditors looking to size up a company’s security.

The code for Forseti is available on GitHub. Google and Spotify have also set up a separate website for the project that offers technical explainers.

Other cloud providers are likewise bolstering their security capabilities. Last month, Amazon Web Services Inc. introduced a tool called Macie that uses machine learning algorithms to help customers keep an eye on confidential records.

Image: Google