Buckets Should Not Allow Public Ownership
More Info:
Ensure that cloud Storage buckets do not allow All Users to have Ownership (“allUsers” must not have “OWNER” roles)Risk Level
CriticalAddress
SecurityCompliance Standards
HITRUST, SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Buckets Should Not Allow Public Ownership” for GCP using GCP console, please follow the below steps:
- Open the GCP console and navigate to the Cloud Storage page.
- Select the bucket that you want to remediate.
- Click on the “Permissions” tab.
- Under the “Members” section, look for any member or group that has the “Storage Object Viewer” or “Storage Object Admin” role assigned.
- Remove the member or group by clicking on the “X” icon next to their name.
- Repeat Step 4 and Step 5 for all members or groups that have any Storage Object role assigned.
- Click on the “Add” button to add a new member or group.
- In the “Add members” dialog box, enter the email address of the member or group that you want to grant access to.
- Select the appropriate role for the member or group from the “Select a role” drop-down menu.
- Click on the “Add” button to add the member or group to the bucket.
- Repeat Step 8 to Step 10 for all members or groups that need access to the bucket.
- Click on the “Save” button to save the changes.
Using CLI
Using CLI
To remediate the misconfiguration “Buckets Should Not Allow Public Ownership” for GCP using GCP CLI, follow these steps:Replace [BUCKET_NAME] with the name of the bucket that has public ownership.Replace [BUCKET_NAME] with the name of the bucket that has public ownership.
- Open the Google Cloud Console and select the project in which the bucket is located.
- Open the Cloud Shell by clicking on the icon on the top right corner of the console.
- In the Cloud Shell, run the following command to list all the buckets in the project:
- Identify the bucket that has public ownership.
- Run the following command to remove public ownership from the bucket:
- Verify that public ownership has been removed by running the following command:
- If the command output shows that allUsers has no permissions on the bucket, you have successfully remediated the misconfiguration.
Using Python
Using Python
To remediate the misconfiguration “Buckets Should Not Allow Public Ownership” in GCP, we can follow these steps using Python:
-
Install the Google Cloud Storage library for Python using the following command:
- Create a service account with the necessary permissions to access the GCP project where the bucket is located. Download the JSON key file for the service account and save it securely.
-
Use the following Python code to check if any of the buckets in the project have public ownership:
-
If any buckets have public ownership, use the following Python code to remove the public access:
- Run the code to remediate the misconfiguration. Verify that the buckets no longer have public ownership by checking their IAM settings in the GCP Console.