Cloud Monitoring Should Monitor Storage ACL Operations Count

More Info:

Ensure Cloud Monitoring monitors storage ACL operations count.

Risk Level

Medium

Address

Security

Compliance Standards

APRA CPS 234 (Australia)
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
Cloudanix Best Practice
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST SP 800-171
NYDFS 23 NYCRR 500
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of not monitoring Storage ACL Operations Count in GCP using GCP console, please follow the below steps:

Open the GCP console and select the desired project in which the storage bucket is located.
Navigate to the Cloud Storage section from the left-hand menu.
Select the storage bucket for which you want to enable monitoring of ACL operations count.
Click on the "Edit bucket permissions" button located at the top of the page.
In the "Bucket Permissions" section, click on the "Add members" button.
Enter the email address of the user or service account that will be responsible for monitoring the Storage ACL Operations Count.
Select the "Storage Legacy Bucket Reader" role from the "Select a role" dropdown menu.
Click on the "Add" button to add the user or service account to the bucket permissions.
Once the user or service account has been added, navigate to the "Monitoring" section of the storage bucket.
In the "Monitoring" section, click on the "Create Policy" button.
Enter a name for the policy and select the "Metric" option.
In the "Filter" section, select the "Storage > Bucket" option from the dropdown menu.
Select the storage bucket for which you want to monitor the ACL operations count.
In the "Condition" section, select the "Metric Threshold" option.
Set the threshold value for the ACL operations count and select the time interval for which you want to monitor the metric.
Click on the "Save" button to save the policy.

By following these steps, you will be able to remediate the misconfiguration of not monitoring Storage ACL Operations Count in GCP using GCP console.

Using CLI

To remediate the misconfiguration of not monitoring Storage ACL operations count in GCP using GCP CLI, you can follow the below steps:

Open the Cloud Shell in the GCP console.
Run the following command to create a new bucket in the project:
```
gsutil mb gs://<bucket-name>
```
Run the following command to enable logging for the bucket:
```
gsutil logging set on -b gs://<bucket-name> gs://<log-bucket-name>/<log-object-prefix>
```
Replace <bucket-name> with the name of the bucket that you created in step 2, and <log-bucket-name> and <log-object-prefix> with the name of the bucket and object prefix where you want to store the logs.

Run the following command to create a new sink for the logs:

gcloud logging sinks create <sink-name> storage.googleapis.com/<bucket-name> --include-children --log-filter='resource.type="gcs_bucket" protoPayload.methodName="storage.buckets.updateIamPolicy" protoPayload.resourceName="projects/_/buckets/<bucket-name>"'

Replace <sink-name> with a name for the new sink, and <bucket-name> with the name of the bucket that you created in step 2.

Run the following command to grant the logging.logWriter role to the sink service account:
```
gcloud projects add-iam-policy-binding <project-id> --member=serviceAccount:<sink-service-account> --role=roles/logging.logWriter
```
Replace <project-id> with the ID of the project that contains the bucket, and <sink-service-account> with the email address of the service account that was created for the sink.
Verify that the sink is working correctly by updating the IAM policy for the bucket:
```
gsutil iam ch allUsers:objectViewer gs://<bucket-name>
```
Check the logs in the log bucket to verify that the sink is working correctly:
```
gsutil ls gs://<log-bucket-name>/<log-object-prefix>
```
This should show a log entry for the IAM policy update that you performed in step 6.

By following these steps, you should be able to remediate the misconfiguration of not monitoring Storage ACL operations count in GCP using GCP CLI.

Using Python

To remediate the misconfiguration "Cloud Monitoring Should Monitor Storage ACL Operations Count" for GCP using Python, follow these steps:

Open the Google Cloud Console and select the project where the storage bucket is located.
Go to the Cloud Storage section.
Find the bucket that needs to be monitored and click on it.
Click on the "Permissions" tab.
Click on the "Add Members" button.
Add the service account that will be used for monitoring. This service account must have the Cloud Monitoring Agent role.
Click on the "Add" button.
Open the Cloud Shell from the Google Cloud Console.
Install the Google Cloud Storage Python library by running the following command:
```
pip install google-cloud-storage
```
Create a Python script that will monitor the ACL operations count for the storage bucket. Here's an example script:

from google.cloud import monitoring_v3
from google.oauth2 import service_account
from google.cloud import storage

# Set up credentials
credentials = service_account.Credentials.from_service_account_file(
    '<path-to-service-account-key>')

# Set up the Monitoring client
client = monitoring_v3.MetricServiceClient(credentials=credentials)

# Set up the Storage client
storage_client = storage.Client(credentials=credentials)

# Set up the metric descriptor
project_name = '<project-name>'
metric_type = 'storage.googleapis.com/storage/bucket/acl/operation_count'
metric_descriptor = monitoring_v3.types.MetricDescriptor()
metric_descriptor.type = metric_type
metric_descriptor.metric_kind = (
    monitoring_v3.enums.MetricDescriptor.MetricKind.CUMULATIVE)
metric_descriptor.value_type = (
    monitoring_v3.enums.MetricDescriptor.ValueType.INT64)
metric_descriptor.description = 'The number of ACL operations on a Cloud Storage bucket.'
metric_descriptor.unit = '1'
client.create_metric_descriptor(
    name=client.project_path(project_name),
    metric_descriptor=metric_descriptor)

# Set up the time series
bucket_name = '<bucket-name>'
time_series = monitoring_v3.types.TimeSeries()
time_series.metric.type = metric_type
time_series.resource.type = 'gcs_bucket'
time_series.resource.labels['bucket_name'] = bucket_name
time_series.resource.labels['project_id'] = project_name

# Get the ACL operations count
bucket = storage_client.bucket(bucket_name)
acl_operations_count = bucket.acl.user("allUsers").get()["operationCount"]

# Set the data point
point = monitoring_v3.types.Point()
point.value.int64_value = acl_operations_count
now = time.time()
point.interval.end_time.seconds = int(now)
point.interval.end_time.nanos = int(
    (now - point.interval.end_time.seconds) * 10**9)
time_series.points.append(point)

# Write the time series data
client.create_time_series(
    name=client.project_path(project_name),
    time_series=[time_series])

Replace the placeholders <path-to-service-account-key>, <project-name>, and <bucket-name> with the actual values.

Save the Python script and run it from the Cloud Shell by running the following command:
```
python <script-name>.py
```
Replace <script-name> with the actual name of the Python script.
Verify that the metric is being collected by going to the Cloud Monitoring section of the Google Cloud Console and checking that the metric is listed under the "Metrics Explorer" tab.

Using Terraform

# This finding cannot be remediated on the "metric" resource type itself:
# Storage ACL operations are already exposed as a built-in metric, and the
# *monitoring* of that metric (thresholds, notifications) is done via an
# alerting policy, not via a metric descriptor.

# Use the built‑in GCS API request metric:
#   metric.type = "storage.googleapis.com/api/request_count"
# and filter to ACL/IAM‑related methods, then apply your desired threshold.

resource "google_monitoring_alert_policy" "storage_acl_operations_count" {
  project      = "PROJECT_ID" # substitute: your GCP project ID
  display_name = "Storage ACL operations count high"
  combiner     = "OR"

  conditions {
    display_name = "Storage ACL operations count exceeds THRESHOLD"

    condition_threshold {
      filter = join(" AND ", [
        # Built‑in metric for GCS API requests
        "metric.type = \"storage.googleapis.com/api/request_count\"",
        # Restrict to storage service
        "resource.type = \"gcs_bucket\"",
        # Restrict to ACL / IAM-related methods (adjust as needed)
        # Example methods:
        #   storage.buckets.getIamPolicy
        #   storage.buckets.setIamPolicy
        #   storage.bucket_acl.list
        #   storage.bucket_acl.insert
        #   storage.bucket_acl.update
        #   storage.bucket_acl.delete
        "metric.label.\"method\" = \"storage.bucket_acl.insert\"",
      ])

      # Substitute your threshold and window:
      # e.g. trigger if > 10 ACL operations in 5 minutes
      comparison      = "COMPARISON_GT"
      threshold_value = 10          # substitute: desired numeric threshold
      duration        = "300s"      # substitute: evaluation window (e.g. 300s)

      aggregations {
        alignment_period   = "60s"
        per_series_aligner = "ALIGN_RATE"
        cross_series_reducer = "REDUCE_SUM"
        group_by_fields    = ["resource.label.\"bucket_name\""]
      }

      trigger {
        count = 1
      }
    }
  }

  notification_channels = [
    "NOTIFICATION_CHANNEL_ID_1", # substitute: channel IDs (email, SMS, etc.)
  ]

  enabled = true

  documentation {
    content  = "High volume of Storage ACL operations detected. Investigate for potential unauthorized access changes."
    mime_type = "text/markdown"
  }
}

terraform plan should show a single new google_monitoring_alert_policy.storage_acl_operations_count to be created and no changes to existing resources.

Additional Reading:

https://cloud.google.com/monitoring/api/metrics_gcp

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

Additional Reading:​