Bigtable Cluster Backups Should Be Encrypted With Customer Managed Keys

Using Console

To remediate the misconfiguration “Bigtable Cluster Backups Should Be Encrypted With Customer Managed Keys” for GCP using GCP console, follow these steps:

Open the Google Cloud Console and select the project where your Bigtable cluster is located.
Go to the Cloud Bigtable section of the console and select your Bigtable instance.
Click on the “Backups” tab and select the backup that you want to encrypt with a customer-managed key.
Click on the “Edit” button next to the backup.
In the “Encryption” section, select “Customer-managed key” from the drop-down menu.
Click on the “Select a key” button and choose the customer-managed key that you want to use to encrypt the backup.
Click on the “Save” button to save the changes.
Repeat steps 3-7 for all the backups associated with your Bigtable cluster.

By following these steps, you will remediate the misconfiguration by encrypting your Bigtable cluster backups with customer-managed keys.

Using CLI

To remediate the misconfiguration of Bigtable Cluster Backups not being encrypted with customer-managed keys, you can follow the below steps using GCP CLI:

Create a new key ring:

gcloud kms keyrings create [KEYRING_NAME] --location=[LOCATION]

Replace [KEYRING_NAME] with the name of the key ring you want to create and [LOCATION] with the location where you want to create the key ring.

Create a new key:

gcloud kms keys create [KEY_NAME] --keyring=[KEYRING_NAME] --location=[LOCATION] --purpose=encryption

Replace [KEY_NAME] with the name of the key you want to create and [KEYRING_NAME] and [LOCATION] with the name of the key ring and location where you created the key ring in step 1.

Grant the Cloud Key Management Service (KMS) service account permission to access the key:

gcloud kms keys add-iam-policy-binding [KEY_NAME] --keyring=[KEYRING_NAME] --location=[LOCATION] --member=serviceAccount:cloudkms@[PROJECT_ID].iam.gserviceaccount.com --role=roles/cloudkms.cryptoKeyEncrypterDecrypter

Replace [KEY_NAME], [KEYRING_NAME], [LOCATION], and [PROJECT_ID] with the name of the key, key ring, location, and project ID where you created the key ring.

Enable encryption for Bigtable backups:

gcloud beta bigtable clusters update [CLUSTER_ID] --backup-encryption-key=[KEY_NAME] --backup-encryption-key-version=1

Replace [CLUSTER_ID] with the ID of the Bigtable cluster you want to update, [KEY_NAME] with the name of the key you created in step 2, and 1 with the version number of the key.After following these steps, all new backups for the Bigtable cluster will be encrypted with the customer-managed key.

Using Python

To remediate the misconfiguration of Bigtable Cluster Backups Should Be Encrypted With Customer Managed Keys in GCP, you can follow the below steps using Python:

First, create a customer-managed encryption key (CMEK) in the Cloud Key Management Service (KMS) using the following code:

from google.cloud import kms_v1
from google.cloud.kms_v1 import enums

def create_key(project_id, location_id, key_ring_id, key_id):
    client = kms_v1.KeyManagementServiceClient()
    parent = client.key_ring_path(project_id, location_id, key_ring_id)

    purpose = enums.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT
    algorithm = enums.CryptoKeyVersion.CryptoKeyVersionAlgorithm.GOOGLE_SYMMETRIC_ENCRYPTION

    crypto_key = {
        'purpose': purpose,
        'version_template': {
            'algorithm': algorithm
        }
    }

    response = client.create_crypto_key(parent, key_id, crypto_key)

    print('Created key: {}'.format(response.name))

Next, enable encryption for your Bigtable cluster backups using the CMEK you just created:

from google.cloud import bigtable_admin_v2
from google.cloud.bigtable_admin_v2 import enums

def enable_backup_encryption(project_id, instance_id, cluster_id, key_name):
    client = bigtable_admin_v2.BigtableTableAdminClient()
    cluster_name = client.cluster_path(project_id, instance_id, cluster_id)
    encryption_config = {
        'encryption_type': enums.EncryptionInfo.EncryptionType.GOOGLE_DEFAULT_ENCRYPTION,
        'encryption_info': {
            'kms_key_name': key_name
        }
    }
    cluster = client.get_cluster(cluster_name)
    cluster.encryption_config = encryption_config
    update_mask = {
        'paths': [
            'encryption_config'
        ]
    }
    client.update_cluster(cluster, update_mask)

Finally, verify that encryption is enabled for your Bigtable cluster backups:

from google.cloud.bigtable import Client

def verify_encryption_enabled(project_id, instance_id, cluster_id):
    client = Client(project=project_id, admin=True)
    cluster = client.instance(instance_id).cluster(cluster_id)
    if cluster.encryption_config.encryption_type == enums.EncryptionInfo.EncryptionType.GOOGLE_DEFAULT_ENCRYPTION:
        print('Encryption is enabled for cluster backups.')
    else:
        print('Encryption is not enabled for cluster backups.')

Note: Make sure to replace project_id, location_id, key_ring_id, key_id, instance_id, cluster_id, and key_name with your own values.By following these steps, you can remediate the misconfiguration of Bigtable Cluster Backups Should Be Encrypted With Customer Managed Keys in GCP using Python.

Using Terraform

# Customer-managed Cloud KMS key used to encrypt Bigtable backups
resource "google_kms_crypto_key" "bigtable_backup_cmek" {
  name            = "BIGTABLE_BACKUP_CMEK_NAME"        # e.g. "bigtable-backup-cmek"
  key_ring        = "PROJECTS/PROJECT_ID/LOCATIONS/LOCATION/KEYRINGS/KEY_RING_NAME"
  rotation_period = "2592000s"                         # 30 days; adjust as needed
}

# Allow Bigtable service account to use the CMK for encryption/decryption
# Replace PROJECT_NUMBER with your numeric project ID
resource "google_kms_crypto_key_iam_member" "bigtable_backup_cmek_user" {
  crypto_key_id = google_kms_crypto_key.bigtable_backup_cmek.id
  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
  member        = "serviceAccount:service-PROJECT_NUMBER@gcp-sa-bigtable.iam.gserviceaccount.com"
}

# Bigtable backup encrypted with the CMK
resource "google_bigtable_backup" "backup" {
  name          = "BIGTABLE_BACKUP_NAME"     # substitute your backup name
  instance_name = "BIGTABLE_INSTANCE_NAME"   # e.g. "my-instance"
  cluster       = "BIGTABLE_CLUSTER_NAME"    # e.g. "my-cluster"
  table         = "BIGTABLE_TABLE_NAME"      # e.g. "my-table"
  expire_time   = "YYYY-MM-DDThh:mm:ssZ"     # RFC3339; set per your retention

  # CMEK for the backup
  kms_key_name = google_kms_crypto_key.bigtable_backup_cmek.id
}

Changing kms_key_name on an existing google_bigtable_backup forces replacement of the backup; existing backup data will not be re-encrypted in place and the original backup will be destroyed when Terraform applies the replacement.To verify, terraform plan should show each affected google_bigtable_backup gaining kms_key_name = (known after apply) and that this change requires replacement for backups that previously had no CMEK configured.

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

Bigtable Cluster Backups Should Be Encrypted With Customer Managed Keys

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: