Buckets Should Not Allow All Authenticated Users Ownership

More Info:

Ensure that cloud Storage buckets do not allow All Authenticated Users Ownership (allAuthenticatedUsers must not have OWNER roles)

Risk Level

High

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration "Buckets Should Not Allow All Authenticated Users Ownership" in GCP using GCP console, follow the below steps:

1. Open the GCP console and navigate to the Cloud Storage page.

2. Select the bucket for which you want to remediate the misconfiguration.

3. Click on the "Edit bucket permissions" button at the top of the page.

4. In the "Add members" field, enter the email address of the user or group that you want to grant permission to.

5. Select the appropriate permission level from the dropdown list - either "Storage Object Viewer" or "Storage Object Admin".

6. Click on the "Add" button to add the user or group to the bucket's permissions.

7. Now, remove the "allAuthenticatedUsers" group from the bucket's permissions by clicking on the "X" beside it.

8. Click on the "Save" button to save the changes.

9. Verify that the misconfiguration has been remediated by checking that the "allAuthenticatedUsers" group is no longer listed in the bucket's permissions.

By following these steps, you have successfully remediated the misconfiguration "Buckets Should Not Allow All Authenticated Users Ownership" in GCP using GCP console.

Using CLI

To remediate the misconfiguration "Buckets Should Not Allow All Authenticated Users Ownership" in GCP, you can follow these step-by-step instructions using GCP CLI:

1. Open your terminal and install the Google Cloud SDK if you haven't already done so.

2. Authenticate to your GCP account by running the following command:

gcloud auth login

3. Once you are authenticated, set the project that contains the bucket you want to remediate by running the following command:

gcloud config set project [PROJECT_ID]

4. Next, identify the bucket that has the misconfiguration by running the following command:

gsutil ls

This command will list all the buckets in your project.

5. Once you have identified the bucket, run the following command to remove the "allAuthenticatedUsers" permission from the bucket's ownership:

gsutil iam ch -d allAuthenticatedUsers:objectOwner gs://[BUCKET_NAME]

This command will remove the "objectOwner" role from the "allAuthenticatedUsers" group, which means that they will no longer have ownership permission on the objects in the bucket.

6. Finally, run the following command to verify that the misconfiguration has been remediated:

gsutil iam get gs://[BUCKET_NAME]

This command will display the current IAM policy for the bucket, which should no longer include the "allAuthenticatedUsers" group with the "objectOwner" role.

Congratulations! You have successfully remediated the misconfiguration "Buckets Should Not Allow All Authenticated Users Ownership" in GCP using GCP CLI.

Using Python

To remediate the "Buckets Should Not Allow All Authenticated Users Ownership" misconfiguration in GCP, you can use the following steps:

Step 1: Install the required libraries

pip install google-cloud-storage

Step 2: Set up authentication

from google.oauth2 import service_account

credentials = service_account.Credentials.from_service_account_file('<path_to_service_account_file>')

Step 3: Get the list of all buckets

from google.cloud import storage

storage_client = storage.Client(credentials=credentials)
buckets = storage_client.list_buckets()

Step 4: Iterate through each bucket and check if "allAuthenticatedUsers" has ownership

for bucket in buckets:
    bucket_acl = bucket.acl
    for entry in bucket_acl:
        if entry.entity_type == "user" and entry.identifier == "allAuthenticatedUsers":
            bucket_acl.delete_entry(entry)
    bucket.acl.save()

This code will remove the "allAuthenticatedUsers" ownership from all the buckets in your GCP project.

Using Terraform

resource "google_storage_bucket" "bucket" {
  name          = "BUCKET_NAME"            # replace with your bucket name
  location      = "BUCKET_LOCATION"        # e.g. "US"
  storage_class = "STANDARD"
}

# If you are using IAM *bindings* on the bucket, ensure none grant OWNER to allAuthenticatedUsers.
# This example keeps OWNER on specific members only.
resource "google_storage_bucket_iam_binding" "bucket_owner_binding" {
  bucket = google_storage_bucket.bucket.name
  role   = "roles/storage.legacyBucketOwner" # or "roles/storage.admin", as used in your env

  members = [
    "user:OWNER_USER@example.com",           # replace with actual principals
    "serviceAccount:OWNER_SA@PROJECT_ID.iam.gserviceaccount.com",
    # DO NOT include "allAuthenticatedUsers"
  ]
}

# If you were previously granting OWNER via a separate binding to allAuthenticatedUsers, remove it.
# For example, delete any resource like this from your Terraform:
#
# resource "google_storage_bucket_iam_binding" "bad_all_auth_owner" {
#   bucket  = google_storage_bucket.bucket.name
#   role    = "roles/storage.legacyBucketOwner"
#   members = ["allAuthenticatedUsers"]      # this must be removed
# }

This change does not force replacement of the bucket; it only updates IAM on the existing bucket.

Verification: terraform plan should show removal of any members = ["allAuthenticatedUsers"] (or similar lists containing allAuthenticatedUsers) from IAM bindings with OWNER-level roles and no bucket recreation.