Buckets Should Not Allow All Authenticated Users Ownership
More Info:
Ensure that cloud Storage buckets do not allow All Authenticated Users Ownership (“allAuthenticatedUsers” must not have “OWNER” roles)Risk Level
HighAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Buckets Should Not Allow All Authenticated Users Ownership” in GCP using GCP console, follow the below steps:
- Open the GCP console and navigate to the Cloud Storage page.
- Select the bucket for which you want to remediate the misconfiguration.
- Click on the “Edit bucket permissions” button at the top of the page.
- In the “Add members” field, enter the email address of the user or group that you want to grant permission to.
- Select the appropriate permission level from the dropdown list - either “Storage Object Viewer” or “Storage Object Admin”.
- Click on the “Add” button to add the user or group to the bucket’s permissions.
- Now, remove the “allAuthenticatedUsers” group from the bucket’s permissions by clicking on the “X” beside it.
- Click on the “Save” button to save the changes.
- Verify that the misconfiguration has been remediated by checking that the “allAuthenticatedUsers” group is no longer listed in the bucket’s permissions.
Using CLI
Using CLI
To remediate the misconfiguration “Buckets Should Not Allow All Authenticated Users Ownership” in GCP, you can follow these step-by-step instructions using GCP CLI:This command will list all the buckets in your project.This command will remove the “objectOwner” role from the “allAuthenticatedUsers” group, which means that they will no longer have ownership permission on the objects in the bucket.This command will display the current IAM policy for the bucket, which should no longer include the “allAuthenticatedUsers” group with the “objectOwner” role.Congratulations! You have successfully remediated the misconfiguration “Buckets Should Not Allow All Authenticated Users Ownership” in GCP using GCP CLI.
- Open your terminal and install the Google Cloud SDK if you haven’t already done so.
- Authenticate to your GCP account by running the following command:
- Once you are authenticated, set the project that contains the bucket you want to remediate by running the following command:
- Next, identify the bucket that has the misconfiguration by running the following command:
- Once you have identified the bucket, run the following command to remove the “allAuthenticatedUsers” permission from the bucket’s ownership:
- Finally, run the following command to verify that the misconfiguration has been remediated:
Using Python
Using Python
To remediate the “Buckets Should Not Allow All Authenticated Users Ownership” misconfiguration in GCP, you can use the following steps:Step 1: Install the required librariesStep 2: Set up authenticationStep 3: Get the list of all bucketsStep 4: Iterate through each bucket and check if “allAuthenticatedUsers” has ownershipThis code will remove the “allAuthenticatedUsers” ownership from all the buckets in your GCP project.