Buckets Should Not Allow All Authenticated User Reads
More Info:
Ensure that cloud Storage buckets do not allow All Authenticated User Reads (“allAuthenticatedUsers” must not have “READER” roles)Risk Level
HighAddress
SecurityCompliance Standards
NISTTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Buckets Should Not Allow All Authenticated User Reads” for GCP using GCP console, follow the below steps:
- Open the GCP console and go to the Cloud Storage page.
- Select the bucket for which you want to remediate the misconfiguration.
- Click on the “Permissions” tab.
- Under the “Members” section, locate the “allAuthenticatedUsers” entry.
- Click on the pencil icon next to the “allAuthenticatedUsers” entry to edit its permissions.
- In the “Select a role” dropdown, select “Storage Legacy Bucket Reader”.
- Click on the “Save” button to save the changes.
Using CLI
Using CLI
To remediate the misconfiguration “Buckets should not allow all authenticated user reads” in GCP using GCP CLI, follow these steps:
- Open the Cloud Shell in the GCP Console.
-
Run the following command to list all the buckets in your project:
- Identify the bucket that allows all authenticated user reads.
-
Run the following command to remove the allAuthenticatedUsers entity from the bucket’s IAM policy:
Replace [BUCKET_NAME] with the name of the bucket that you want to remediate.
-
Verify that the allAuthenticatedUsers entity has been removed from the bucket’s IAM policy by running the following command:
Replace [BUCKET_NAME] with the name of the bucket that you remediated.
- Repeat these steps for any other buckets that allow all authenticated user reads.
Using Python
Using Python
To remediate the issue of buckets allowing all authenticated user reads in GCP using Python, you can use the following steps:By following these steps, you can remediate the issue of buckets allowing all authenticated user reads in GCP using Python.
- Install the Google Cloud Storage Python library by running the following command:
- Authenticate with your GCP account by setting the
GOOGLE_APPLICATION_CREDENTIALSenvironment variable to the path of your service account key file. You can create a service account and download the key file from the GCP console.
- Use the
google-cloud-storagelibrary to get a list of all buckets in your project.
- For each bucket, check if it allows all authenticated users to read. If it does, update the bucket’s IAM policy to remove the
allAuthenticatedUsersrole from theroles/storage.objectViewerrole.
- Verify that the issue has been remediated by checking the IAM policy for each bucket.