Skip to main content

PubSub Subscriptions Should Have Set Message Ordering To

More Info:​

Ensure that PubSub Subscriptions have set message ordering to true

Risk Level​

Low

Address​

Operational Excellence

Compliance Standards​

  • Cloudanix Best Practice

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration "PubSub Subscriptions Should Have Set Message Ordering To True" for GCP using GCP console, follow the below steps:

  1. Login to the GCP console and navigate to the Pub/Sub section.
  2. Click on the subscription that needs to be remediated.
  3. In the subscription details page, click on the "Edit" button on the top.
  4. In the "Edit subscription" page, scroll down to the "Delivery" section.
  5. In the "Delivery" section, enable the "Enable message ordering" checkbox.
  6. Click on the "Save" button to save the changes.

After following the above steps, the message ordering for the subscription will be enabled and the misconfiguration will be remediated.

Using CLI

To remediate the misconfiguration of PubSub subscriptions not having message ordering set to true in GCP using GCP CLI, you can follow the below steps:

  1. Open the Cloud Shell in the GCP Console.

  2. Use the following command to list all the subscriptions in the project:

gcloud pubsub subscriptions list

  1. Identify the subscription(s) that do not have message ordering set to true.

  2. Use the following command to update the subscription(s) to enable message ordering:

gcloud pubsub subscriptions update [SUBSCRIPTION_NAME] --enable-message-ordering

Replace [SUBSCRIPTION_NAME] with the name of the subscription that needs to be updated.

  1. Verify the changes by using the following command to describe the subscription:
gcloud pubsub subscriptions describe [SUBSCRIPTION_NAME]

This will display the details of the subscription, including the "enableMessageOrdering" field set to "true".

By following these steps, you can remediate the misconfiguration of PubSub subscriptions not having message ordering set to true in GCP using GCP CLI.

Using Python

To remediate the misconfiguration "PubSub Subscriptions Should Have Set Message Ordering To True" in GCP using Python, you can follow the below steps:

  1. First, you need to authenticate and authorize your Python script to access your GCP project. You can use the google-auth and google-cloud-pubsub libraries to achieve this.
from google.cloud import pubsub_v1
from google.oauth2 import service_account

# Replace the below values with your GCP project ID and service account credentials file path
PROJECT_ID = 'your-project-id'
SERVICE_ACCOUNT_FILE = '/path/to/your/credentials.json'

# Authenticate and authorize the Python script
credentials = service_account.Credentials.from_service_account_file(SERVICE_ACCOUNT_FILE)
publisher = pubsub_v1.PublisherClient(credentials=credentials)
subscriber = pubsub_v1.SubscriberClient(credentials=credentials)
  1. Next, you need to list all the subscriptions in your GCP project using the list_subscriptions method of the SubscriberClient class.
# List all the subscriptions in your GCP project
project_path = f"projects/{PROJECT_ID}"
for subscription in subscriber.list_subscriptions(request={"project": project_path}):
    print(f"Subscription: {subscription.name}")
  1. For each subscription, you need to check if the message ordering is set to true or not using the get_subscription method of the SubscriberClient class.
# Check if the message ordering is set to true for each subscription
for subscription in subscriber.list_subscriptions(request={"project": project_path}):
    subscription_path = subscription.name
    subscription = subscriber.get_subscription(request={"subscription": subscription_path})
    if subscription.enable_message_ordering:
        print(f"Message ordering is enabled for subscription {subscription_path}")
    else:
        print(f"Message ordering is not enabled for subscription {subscription_path}")
  1. If the message ordering is not enabled for a subscription, you need to update the subscription to enable message ordering using the update_subscription method of the SubscriberClient class.
# Enable message ordering for the subscription
if not subscription.enable_message_ordering:
    update_mask = {"paths": ["enable_message_ordering"]}
    subscription.enable_message_ordering = True
    subscriber.update_subscription(request={"subscription": subscription, "update_mask": update_mask})
    print(f"Message ordering is enabled for subscription {subscription_path}")

By following the above steps, you can remediate the misconfiguration "PubSub Subscriptions Should Have Set Message Ordering To True" in GCP using Python.

Using Terraform
resource "google_pubsub_subscription" "ORDERED_SUBSCRIPTION" {
  name  = "ORDERED_SUBSCRIPTION_NAME"          # replace with your subscription name
  topic = "projects/PROJECT_ID/topics/TOPIC_NAME"  # replace PROJECT_ID and TOPIC_NAME

  # Remediation: ensure message ordering is enabled
  enable_message_ordering = true

  # include any other existing arguments you already use, e.g.:
  # ack_deadline_seconds = 20
  # push_config { ... }
}

Enabling enable_message_ordering is an in‑place update for an existing subscription and does not require replacement.

Verification: terraform plan should show a single in‑place ~ update on the google_pubsub_subscription resource with enable_message_ordering changing from false (or unset) to true.

Additional Reading:​