Buckets Should Not Have Website Configuration

More Info:

List all the buckets that have website configuration (this is an informational rule only)

Risk Level

Informational

Address

Operational Maturity, Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To list all buckets which have write configuration in GCP, you can follow these steps:

1. Open the GCP Console and navigate to the Cloud Storage page.
2. In the left navigation pane, click on "Storage".
3. Click on the "Buckets" tab.
4. In the "Filter Buckets" search box, type "bindings:writer" and press Enter.
5. This will list all the buckets with write configuration.

To remediate this misconfiguration in GCP, you can follow these steps:

1. Open the GCP Console and navigate to the Cloud Storage page.
2. In the left navigation pane, click on "Storage".
3. Click on the bucket that has write configuration.
4. Click on the "Permissions" tab.
5. In the "Add members" field, enter the email address of the user or service account that you want to grant access to.
6. Select the appropriate role for the user or service account from the "Select a role" drop-down menu.
7. Click the "Add" button to grant the user or service account access to the bucket.
8. Remove any unnecessary write permissions from the bucket by clicking the "Edit" button next to the relevant member and selecting the appropriate role from the "Select a role" drop-down menu.
9. Click the "Save" button to save the changes.

Repeat these steps for all the buckets that have write configuration.

Using CLI

To list all buckets which have Write Configuration enabled in GCP, you can use the following command in the GCP CLI:

gsutil ls -L | grep -B 3 -i "allUsers:WRITE"

This command will list all the buckets with Write Configuration enabled. To remediate this issue, you can follow the below steps:

1. Open the GCP Console and navigate to the Cloud Storage page.
2. Click on the name of the bucket that has Write Configuration enabled.
3. Click on the "Permissions" tab.
4. Under the "Public access prevention" section, select "Enforced by organization policy".
5. Click "Save".

This will prevent any public user from having Write Configuration access to the bucket.

Using Python

To list all the buckets which have write configuration in GCP, you can use the following Python code:

from google.cloud import storage

# create a client object
client = storage.Client()

# list all the buckets
buckets = list(client.list_buckets())

# iterate over the buckets and check if it has write configuration
for bucket in buckets:
    bucket_acl = bucket.acl
    for entry in bucket_acl:
        if entry.role == "WRITER":
            print(f"{bucket.name} has write configuration")

To remediate this misconfiguration, you can remove the WRITER role from the bucket's ACL. You can use the following Python code to do this:

from google.cloud import storage

# create a client object
client = storage.Client()

# get the bucket object
bucket = client.get_bucket('bucket-name')

# get the bucket's ACL
bucket_acl = bucket.acl

# remove the writer role from the bucket's ACL
bucket_acl.all().revoke_role('WRITER')

# save the updated ACL
bucket_acl.save()

Note: Make sure to replace bucket-name with the actual name of the bucket. Also, make sure you have the necessary permissions to modify the bucket's ACL.

Using Terraform

resource "google_storage_bucket" "EXAMPLE_BUCKET" {
  name                        = "YOUR_BUCKET_NAME"          # replace with your bucket name
  location                    = "YOUR_BUCKET_LOCATION"      # e.g. "US", "EU", "us-central1"
  storage_class               = "STANDARD"
  force_destroy               = false
  uniform_bucket_level_access = true

  # IMPORTANT:
  # To remediate "Buckets Should Not Have Website Configuration",
  # ensure there is NO `website { ... }` block here.
  #
  # If you currently have:
  #
  # website {
  #   main_page_suffix = "index.html"
  #   not_found_page   = "404.html"
  # }
  #
  # remove that entire block from Terraform.
}

Removing the website {} configuration from google_storage_bucket updates the bucket in place and does not force replacement.

For verification, terraform plan should show the website block being removed from the bucket (a - website { ... } diff and no new bucket creation).