Skip to main content

More Info:

Ensure that cloud Storage buckets following a DNS-compliant naming scheme, which avoid the use of a period i.e. .

Risk Level

Low

Address

Operational Maturity, Security

Compliance Standards

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

Sure, here are the step-by-step instructions to remediate this misconfiguration in GCP using the GCP console:
  1. Open the GCP Console and select the project where the bucket is located.
  2. Navigate to the Cloud Storage section from the left-hand menu.
  3. Select the bucket that you want to remediate.
  4. Click on the “Edit bucket details” button at the top of the page.
  5. In the “Name” field, enter a DNS-compliant name for the bucket. The name should only contain lowercase letters, numbers, and hyphens, and should start and end with a letter or number.
  6. Click the “Save” button to save the changes.
Once you have completed these steps, the bucket will have a DNS-compliant name and the misconfiguration will be remediated.

To remediate the misconfiguration “Buckets Should Have DNS Compliant Names” in GCP using GCP CLI, please follow the below steps:
  1. Open the Cloud Shell in your GCP Console.
  2. Run the following command to list all the buckets in your project:
  1. Identify the bucket that has a non-DNS compliant name.
  2. Run the following command to rename the bucket with a DNS compliant name:
Note: Replace <old-bucket-name> with the non-DNS compliant bucket name and <new-bucket-name> with a DNS compliant bucket name.
  1. Verify that the bucket has been renamed successfully by running the following command:
  1. Repeat the above steps for all the non-DNS compliant buckets in your project.
By following these steps, you can remediate the misconfiguration “Buckets Should Have DNS Compliant Names” in GCP using GCP CLI.
To remediate the misconfiguration “Buckets Should Have DNS Compliant Names” in GCP using Python, follow these steps:
  1. Install the Google Cloud Storage Python library using the following command:
  1. Create a Python script to check the bucket name and modify it if necessary. Here’s an example script:
  1. Replace <BUCKET_NAME> with the name of your bucket in the script.
  2. Run the script and it will check if the bucket name is DNS compliant. If it is not compliant, the script will modify the bucket name to make it compliant. If the bucket name is already compliant, the script will print a message saying so.
Note: It is important to test the script thoroughly before running it in a production environment. Also, you should ensure that the bucket name is not already being used by another bucket in your GCP project.
Changing the name of a google_storage_bucket forces replacement of the bucket (destroy and recreate), and existing data will not be preserved automatically—migrate data before applying.To verify, terraform plan should show the existing google_storage_bucket being destroyed and a new one created with the updated name that has no periods.