Skip to main content

Buckets Should Have DNS Compliant Names

More Info:​

Ensure that cloud Storage buckets following a DNS-compliant naming scheme, which avoid the use of a period i.e. .

Risk Level​

Low

Address​

Operational Maturity, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Sure, here are the step-by-step instructions to remediate this misconfiguration in GCP using the GCP console:

  1. Open the GCP Console and select the project where the bucket is located.
  2. Navigate to the Cloud Storage section from the left-hand menu.
  3. Select the bucket that you want to remediate.
  4. Click on the "Edit bucket details" button at the top of the page.
  5. In the "Name" field, enter a DNS-compliant name for the bucket. The name should only contain lowercase letters, numbers, and hyphens, and should start and end with a letter or number.
  6. Click the "Save" button to save the changes.

Once you have completed these steps, the bucket will have a DNS-compliant name and the misconfiguration will be remediated.

Using CLI

To remediate the misconfiguration "Buckets Should Have DNS Compliant Names" in GCP using GCP CLI, please follow the below steps:

  1. Open the Cloud Shell in your GCP Console.

  2. Run the following command to list all the buckets in your project:

gsutil ls

  1. Identify the bucket that has a non-DNS compliant name.

  2. Run the following command to rename the bucket with a DNS compliant name:

gsutil mv gs://<old-bucket-name> gs://<new-bucket-name>

Note: Replace <old-bucket-name> with the non-DNS compliant bucket name and <new-bucket-name> with a DNS compliant bucket name.

  1. Verify that the bucket has been renamed successfully by running the following command:
gsutil ls
  1. Repeat the above steps for all the non-DNS compliant buckets in your project.

By following these steps, you can remediate the misconfiguration "Buckets Should Have DNS Compliant Names" in GCP using GCP CLI.

Using Python

To remediate the misconfiguration "Buckets Should Have DNS Compliant Names" in GCP using Python, follow these steps:

  1. Install the Google Cloud Storage Python library using the following command:
!pip install google-cloud-storage
  1. Create a Python script to check the bucket name and modify it if necessary. Here's an example script:
from google.cloud import storage

def remediate_bucket_name(bucket_name):
    """
    Check if the bucket name is DNS compliant and modify it if necessary.
    """
    if not bucket_name.islower():
        # Convert bucket name to lowercase
        bucket_name = bucket_name.lower()
        
    if not bucket_name.isalnum():
        # Replace non-alphanumeric characters with hyphens
        bucket_name = bucket_name.replace('_', '-')
        bucket_name = re.sub(r'[^a-zA-Z0-9-]+', '', bucket_name)
        
    if bucket_name.startswith('-') or bucket_name.endswith('-'):
        # Remove leading or trailing hyphens
        bucket_name = bucket_name.strip('-')
        
    if len(bucket_name) < 3 or len(bucket_name) > 63:
        # Bucket name must be between 3 and 63 characters long
        bucket_name = bucket_name[:63]
        bucket_name = bucket_name.strip('-')
        
    return bucket_name

# Replace <BUCKET_NAME> with the name of your bucket
bucket_name = "<BUCKET_NAME>"

# Create a client object
client = storage.Client()

# Get the bucket object
bucket = client.get_bucket(bucket_name)

# Get the current bucket name
current_name = bucket.name

# Check if the current name is DNS compliant
if current_name != remediate_bucket_name(current_name):
    # Modify the bucket name
    new_name = remediate_bucket_name(current_name)
    bucket.rename(new_name)
    print(f"Bucket name has been changed from {current_name} to {new_name}.")
else:
    print("Bucket name is DNS compliant.")

  1. Replace <BUCKET_NAME> with the name of your bucket in the script.

  2. Run the script and it will check if the bucket name is DNS compliant. If it is not compliant, the script will modify the bucket name to make it compliant. If the bucket name is already compliant, the script will print a message saying so.

Note: It is important to test the script thoroughly before running it in a production environment. Also, you should ensure that the bucket name is not already being used by another bucket in your GCP project.

Using Terraform
resource "google_storage_bucket" "DNS_COMPLIANT_BUCKET" {
  # Replace PROJECT_ID with your GCP project ID
  project = "PROJECT_ID"

  # Replace OLD_BUCKET_NAME_WITH_DOTS with the current (non‑compliant) bucket name,
  # then change this to a new DNS-compliant name that does NOT contain periods.
  # Example: "my-app-logs" instead of "my.app.logs"
  name     = "NEW_DNS_COMPLIANT_BUCKET_NAME_NO_DOTS"
  location = "BUCKET_LOCATION"

  # Add any other required arguments you already use (e.g., uniform_bucket_level_access, versioning, etc.)
}

Changing the name of a google_storage_bucket forces replacement of the bucket (destroy and recreate), and existing data will not be preserved automatically—migrate data before applying.

To verify, terraform plan should show the existing google_storage_bucket being destroyed and a new one created with the updated name that has no periods.