> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Bucket Should Not Allow Global Access ### More Info: Ensures Storage bucket policies do not allow global write, delete, or read permissions. Storage buckets can be configured to allow the global principal to access the bucket via the bucket policy. This policy should be restricted only to known users or accounts. ### Risk Level Critical ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CIS GCP * CIS GCP 2.0.0 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * FedRAMP * GDPR * HIPAA * HITRUST CSF * ISO 27001 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * Reserve Bank of India (RBI) Cyber Security Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the "Bucket Should Not Allow Global Access" misconfiguration for GCP using GCP console, follow these steps: 1. Go to the GCP console and select the project that contains the bucket with global access. 2. Navigate to the Cloud Storage section of the console. 3. Find the bucket that is allowing global access and click on its name to open its details page. 4. Click on the "Permissions" tab. 5. Scroll down to the "Public access prevention" section and click on the "Edit" button. 6. In the "Public access prevention" window, select the "Enforced by Bucket Policy" option. 7. Click on the "Save" button to apply the changes. 8. Next, click on the "Bucket Policy" tab. 9. In the bucket policy editor, enter the following JSON code to deny all public access to the bucket: ``` { "bindings": [ { "members": [ "allUsers" ], "role": "roles/storage.objectViewer" } ], "effect": "deny", "condition": { "bool": { "values": [ true ] } } } ``` 10. Click on the "Save" button to apply the policy. After following these steps, the bucket will no longer allow global access and all public access will be denied. # To remediate the bucket should not allow global access misconfiguration in GCP using GCP CLI, follow these steps: 1. Open the Google Cloud Console and navigate to the Cloud Shell. 2. Run the following command to list all the buckets in your project: ``` gsutil ls ``` 3. Identify the bucket that has global access enabled. 4. Run the following command to remove the public access from the bucket: ``` gsutil iam ch allUsers:objectViewer gs://[BUCKET_NAME] ``` Replace \[BUCKET\_NAME] with the name of the bucket that you identified in step 3. 5. Run the following command to verify that the public access has been removed: ``` gsutil iam get gs://[BUCKET_NAME] ``` This command will display the IAM policy for the bucket. Verify that the "allUsers" entity no longer has the "roles/storage.objectViewer" role. 6. Repeat steps 3 to 5 for all the buckets in your project that have global access enabled. By following these steps, you can remediate the bucket should not allow global access misconfiguration in GCP using GCP CLI. To remediate the "Bucket Should Not Allow Global Access" misconfiguration in GCP using Python, you can follow the below steps: Step 1: Install and import the required libraries ``` !pip install google-cloud-storage from google.cloud import storage ``` Step 2: Authenticate with GCP using service account credentials ``` storage_client = storage.Client.from_service_account_json('path/to/service_account.json') ``` Step 3: Get the bucket object that you want to remediate ``` bucket_name = "your-bucket-name" bucket = storage_client.get_bucket(bucket_name) ``` Step 4: Set the bucket's IAM policy to deny all public access ``` policy = bucket.get_iam_policy(requested_policy_version=3) policy.bindings.append( { "role": "roles/storage.objectViewer", "members": {"allUsers"}, "condition": { "title": "Deny access to objects if they are not authenticated", "description": "Requests from user accounts without authentication are not allowed.", "expression": "request.auth != null", }, } ) bucket.set_iam_policy(policy) ``` Step 5: Verify that the bucket's IAM policy has been updated to deny all public access ``` policy = bucket.get_iam_policy(requested_policy_version=3) for binding in policy.bindings: if binding["role"] == "roles/storage.objectViewer" and "allUsers" in binding["members"]: print("Global access has been denied.") ``` By following these steps, you can remediate the "Bucket Should Not Allow Global Access" misconfiguration in GCP using Python. ```hcl theme={null} resource "google_storage_bucket" "bucket" { name = "BUCKET_NAME" # replace with your bucket name location = "BUCKET_LOCATION" # e.g. "US", "EUROPE-WEST1" } # Replace any bindings that currently use allUsers / allAuthenticatedUsers # with principals from your project / org. Do NOT include: # - "allUsers" # - "allAuthenticatedUsers" resource "google_storage_bucket_iam_binding" "object_viewers" { bucket = google_storage_bucket.bucket.name role = "roles/storage.objectViewer" members = [ "user:USER_EMAIL@example.com", # replace with real user(s) "serviceAccount:SERVICE_ACCOUNT@PROJECT.iam.gserviceaccount.com", # add more allowed principals as needed ] } resource "google_storage_bucket_iam_binding" "object_admins" { bucket = google_storage_bucket.bucket.name role = "roles/storage.objectAdmin" members = [ "group:GROUP_EMAIL@example.com", # replace with real group(s) ] } ``` Changing IAM bindings does **not** force replacement of the bucket resource; it updates access in place. To remediate an existing bucket that already has public access, make sure you either: * Remove the old binding that contains `allUsers` / `allAuthenticatedUsers` from Terraform, or * Replace that binding’s `members` list so it no longer contains those values and instead lists specific principals as above. Verification: `terraform plan` should show the `members` lists on `google_storage_bucket_iam_binding` resources changing to remove `allUsers` / `allAuthenticatedUsers` (or those bindings being destroyed), with the bucket itself left unchanged. ### Additional Reading: * [https://cloud.google.com/storage/docs/access-control/iam](https://cloud.google.com/storage/docs/access-control/iam)