Ensure that BigQuery datasets are not anonymously or publicly accessible
More Info:
It is recommended that the IAM policy on BigQuery datasets does not allow anonymous and/or public access.Risk Level
MediumAddress
SecurityCompliance Standards
CISGCP, CBP, HITRUST, GDPR, SOC2, NISTCSF, PCIDSS, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
To remediate this misconfiguration in GCP using GCP console, you can follow these steps:
- Open the GCP console and navigate to the BigQuery section.
- Click on the dataset that you want to remediate.
- In the dataset details page, click on the “Share dataset” button.
- In the “Share dataset” dialog box, review the current access controls.
- If the dataset is publicly accessible, click on the “X” next to the “allUsers” entry to remove it.
- If the dataset is anonymously accessible, click on the “X” next to the “allAuthenticatedUsers” entry to remove it.
- If you want to grant access to specific users or groups, click on the “Add item” button and enter their email addresses.
- Choose the appropriate access level for the users or groups, such as “Viewer” or “Editor”.
- Click on the “Save” button to apply the changes.
- Finally, verify that the dataset is no longer publicly or anonymously accessible by reviewing the access controls again.
Using CLI
Using CLI
To remediate the misconfiguration of BigQuery datasets being anonymously or publicly accessible in GCP using GCP CLI, follow these steps:Note: Replace Note: Replace
- Open the Cloud Shell from the GCP console.
- Run the following command to list all the datasets in your project:
- For each dataset that is publicly accessible, run the following command to revoke the public access:
<dataset_id> with the ID of the dataset that you want to remediate.- After running the above command, you will see the following prompt:
-
Type
yand press enter to confirm the update. - Repeat steps 3-5 for all the datasets that are publicly accessible.
- Run the following command to verify that the datasets are no longer publicly accessible:
<dataset_id> with the ID of the dataset that you want to verify.-
Verify that the
defaultTableExpirationMsfield is set to-1in the output. This indicates that the dataset is not publicly accessible. - Repeat step 8 for all the datasets that you have remediated.
Using Python
Using Python
To remediate the misconfiguration of BigQuery datasets being publicly accessible, you can use the following Python code:By following these steps, you can remediate the misconfiguration of BigQuery datasets being publicly accessible in GCP using Python.
- First, you need to authenticate and authorize your Python script to access the Google Cloud Platform. For this, you can use the
google-authandgoogle-auth-oauthliblibraries. Here is an example of how to authenticate and authorize:
- Once you have authenticated and authorized your script, you can use the
google-cloud-bigquerylibrary to access the BigQuery API. Here is an example of how to check if a dataset is publicly accessible:
- If the dataset is publicly accessible, you can revoke the public access by removing the
READERrole for the anonymous user. Here is an example of how to do this: