GCP CNames Missing Storage Bucket
More Info:
Ensure that GCP CNmaes Have Storage BucketRisk Level
HighAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of missing CNames for a GCP storage bucket in GCP DNS using the GCP console, follow these steps:
- Open the GCP Console (https://console.cloud.google.com) and log in to your GCP account.
- Navigate to the Cloud Storage section by clicking on the menu icon in the top-left corner and selecting “Storage” under the “Storage” category.
- Select the storage bucket for which you want to add CNames.
- In the bucket details page, click on the “Edit website configuration” button located in the top bar.
- Scroll down to the “Custom domain” section and click on the “Add a custom domain” button.
- In the “Domain name” field, enter the desired domain name or subdomain for your storage bucket. For example, if you want to use “assets.example.com,” enter “assets” in the field.
- Click on the “Add” button to add the custom domain.
- GCP will validate the domain ownership by providing you with a unique verification token. Copy the token provided.
- Open a new tab or window and navigate to your DNS provider’s website.
- Sign in to your DNS provider’s console and locate the DNS management section.
- Create a new CNAME record for your desired domain or subdomain. In the “Name” or “Host” field, enter the desired domain or subdomain name (e.g., “assets” or “assets.example.com”).
- In the “Value” or “Points to” field, enter the storage bucket URL provided by GCP. It should be in the format “c.storage.googleapis.com” followed by your bucket name (e.g., “c.storage.googleapis.com/example-bucket”).
- Save the CNAME record.
- Return to the GCP console tab and click on the “Verify” button next to the domain you added.
- Paste the verification token you copied earlier into the provided field and click on the “Verify” button.
- Once the domain ownership is verified, click on the “Save” button to apply the changes.
- Wait for DNS propagation to complete, which may take some time (usually a few minutes to a few hours) depending on your DNS provider.
Using CLI
Using CLI
To remediate the misconfiguration of missing CNames for a storage bucket in GCP DNS using GCP CLI, follow these step-by-step instructions:
- Open the GCP Cloud Shell or ensure that you have the GCP CLI (Command Line Interface) installed on your local machine.
-
Authenticate with your GCP account by running the following command:
-
Set the appropriate GCP project where the misconfigured storage bucket resides:
-
Verify the existing DNS records for the project by running:
Replace
<zone_name>with the name of the DNS zone where the storage bucket is located. -
Identify the missing CName record for the storage bucket. It should have a type of
CNAMEand a name corresponding to the desired subdomain. -
Create the CName record using the
gcloud dns record-sets transactioncommand. Start a new transaction by running: -
Add the missing CName record. Replace
<subdomain>with the desired subdomain and<bucket_name>with the name of the storage bucket: -
Commit the transaction to apply the changes:
-
Verify that the CName record has been successfully added by running the following command:
-
Check if the CName record is resolving correctly by using a DNS lookup tool or running the following command:
Replace
<subdomain>and<your_domain>with the appropriate values.
Using Python
Using Python
To remediate the misconfiguration of missing CNames for a GCP Storage Bucket in GCP DNS using Python, follow these step-by-step instructions:
-
Install the necessary libraries:
- Install the Google Cloud SDK by following the instructions provided in the official documentation: https://cloud.google.com/sdk/docs/install
- Install the
google-cloud-dnslibrary using pip:
-
Set up authentication:
- Generate a service account key file for your GCP project by following the steps mentioned in the official documentation: https://cloud.google.com/docs/authentication/getting-started
- Save the generated JSON key file securely on your system.
-
Import the required libraries and authenticate using the service account key file:
-
Retrieve the existing DNS zone:
-
Retrieve the existing records for the zone:
-
Identify the missing CName record for your GCP Storage Bucket:
-
Check if the CName record already exists in the DNS zone:
-
If the CName record doesn’t exist, add it to the DNS zone:
-
Once the CName record is added, verify its existence: