> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Buckets Should Not Have Website Configuration

### More Info:

List all the buckets that have website configuration (this is an informational rule only)

### Risk Level

Informational

### Address

Operational Maturity, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To list all buckets which have write configuration in GCP, you can follow these steps:

        1. Open the GCP Console and navigate to the Cloud Storage page.
        2. In the left navigation pane, click on "Storage".
        3. Click on the "Buckets" tab.
        4. In the "Filter Buckets" search box, type "bindings:writer" and press Enter.
        5. This will list all the buckets with write configuration.

        To remediate this misconfiguration in GCP, you can follow these steps:

        1. Open the GCP Console and navigate to the Cloud Storage page.
        2. In the left navigation pane, click on "Storage".
        3. Click on the bucket that has write configuration.
        4. Click on the "Permissions" tab.
        5. In the "Add members" field, enter the email address of the user or service account that you want to grant access to.
        6. Select the appropriate role for the user or service account from the "Select a role" drop-down menu.
        7. Click the "Add" button to grant the user or service account access to the bucket.
        8. Remove any unnecessary write permissions from the bucket by clicking the "Edit" button next to the relevant member and selecting the appropriate role from the "Select a role" drop-down menu.
        9. Click the "Save" button to save the changes.

        Repeat these steps for all the buckets that have write configuration.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To list all buckets which have Write Configuration enabled in GCP, you can use the following command in the GCP CLI:

        ```
        gsutil ls -L | grep -B 3 -i "allUsers:WRITE"
        ```

        This command will list all the buckets with Write Configuration enabled. To remediate this issue, you can follow the below steps:

        1. Open the GCP Console and navigate to the Cloud Storage page.
        2. Click on the name of the bucket that has Write Configuration enabled.
        3. Click on the "Permissions" tab.
        4. Under the "Public access prevention" section, select "Enforced by organization policy".
        5. Click "Save".

        This will prevent any public user from having Write Configuration access to the bucket.
      </Accordion>

      <Accordion title="Using Python">
        To list all the buckets which have write configuration in GCP, you can use the following Python code:

        ```python theme={null}
        from google.cloud import storage

        # create a client object
        client = storage.Client()

        # list all the buckets
        buckets = list(client.list_buckets())

        # iterate over the buckets and check if it has write configuration
        for bucket in buckets:
            bucket_acl = bucket.acl
            for entry in bucket_acl:
                if entry.role == "WRITER":
                    print(f"{bucket.name} has write configuration")
        ```

        To remediate this misconfiguration, you can remove the `WRITER` role from the bucket's ACL. You can use the following Python code to do this:

        ```python theme={null}
        from google.cloud import storage

        # create a client object
        client = storage.Client()

        # get the bucket object
        bucket = client.get_bucket('bucket-name')

        # get the bucket's ACL
        bucket_acl = bucket.acl

        # remove the writer role from the bucket's ACL
        bucket_acl.all().revoke_role('WRITER')

        # save the updated ACL
        bucket_acl.save()
        ```

        Note: Make sure to replace `bucket-name` with the actual name of the bucket. Also, make sure you have the necessary permissions to modify the bucket's ACL.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_storage_bucket" "EXAMPLE_BUCKET" {
          name                        = "YOUR_BUCKET_NAME"          # replace with your bucket name
          location                    = "YOUR_BUCKET_LOCATION"      # e.g. "US", "EU", "us-central1"
          storage_class               = "STANDARD"
          force_destroy               = false
          uniform_bucket_level_access = true

          # IMPORTANT:
          # To remediate "Buckets Should Not Have Website Configuration",
          # ensure there is NO `website { ... }` block here.
          #
          # If you currently have:
          #
          # website {
          #   main_page_suffix = "index.html"
          #   not_found_page   = "404.html"
          # }
          #
          # remove that entire block from Terraform.
        }
        ```

        Removing the `website {}` configuration from `google_storage_bucket` updates the bucket in place and does not force replacement.

        For verification, `terraform plan` should show the `website` block being removed from the bucket (a `- website { ... }` diff and no new bucket creation).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>