> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Buckets Should Not Allow Public Ownership ### More Info: Ensure that cloud Storage buckets do not allow All Users to have Ownership (allUsers must not have OWNER roles) ### Risk Level Critical ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * HITRUST CSF * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * Reserve Bank of India (RBI) Cyber Security Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration "Buckets Should Not Allow Public Ownership" for GCP using GCP console, please follow the below steps: 1. Open the GCP console and navigate to the Cloud Storage page. 2. Select the bucket that you want to remediate. 3. Click on the "Permissions" tab. 4. Under the "Members" section, look for any member or group that has the "Storage Object Viewer" or "Storage Object Admin" role assigned. 5. Remove the member or group by clicking on the "X" icon next to their name. 6. Repeat Step 4 and Step 5 for all members or groups that have any Storage Object role assigned. 7. Click on the "Add" button to add a new member or group. 8. In the "Add members" dialog box, enter the email address of the member or group that you want to grant access to. 9. Select the appropriate role for the member or group from the "Select a role" drop-down menu. 10. Click on the "Add" button to add the member or group to the bucket. 11. Repeat Step 8 to Step 10 for all members or groups that need access to the bucket. 12. Click on the "Save" button to save the changes. By following these steps, you have successfully remediated the misconfiguration "Buckets Should Not Allow Public Ownership" for GCP using GCP console. # To remediate the misconfiguration "Buckets Should Not Allow Public Ownership" for GCP using GCP CLI, follow these steps: 1. Open the Google Cloud Console and select the project in which the bucket is located. 2. Open the Cloud Shell by clicking on the icon on the top right corner of the console. 3. In the Cloud Shell, run the following command to list all the buckets in the project: ``` gsutil ls ``` 4. Identify the bucket that has public ownership. 5. Run the following command to remove public ownership from the bucket: ``` gsutil iam ch allUsers:objectViewer gs://[BUCKET_NAME] ``` Replace \[BUCKET\_NAME] with the name of the bucket that has public ownership. 6. Verify that public ownership has been removed by running the following command: ``` gsutil iam get gs://[BUCKET_NAME] ``` Replace \[BUCKET\_NAME] with the name of the bucket that has public ownership. 7. If the command output shows that allUsers has no permissions on the bucket, you have successfully remediated the misconfiguration. Note: If you want to prevent public ownership from being set on new buckets, you can set a bucket-level policy that denies the allUsers group the storage.objects.get permission. To remediate the misconfiguration "Buckets Should Not Allow Public Ownership" in GCP, we can follow these steps using Python: 1. Install the Google Cloud Storage library for Python using the following command: ``` pip install google-cloud-storage ``` 2. Create a service account with the necessary permissions to access the GCP project where the bucket is located. Download the JSON key file for the service account and save it securely. 3. Use the following Python code to check if any of the buckets in the project have public ownership: ``` from google.cloud import storage # Replace the following values with your project ID and the path to your JSON key file project_id = 'your-project-id' key_path = '/path/to/your/keyfile.json' # Authenticate with the service account client = storage.Client.from_service_account_json(key_path) # Get a list of all the buckets in the project buckets = client.list_buckets(project=project_id) # Check if any of the buckets have public ownership for bucket in buckets: if bucket.iam_configuration.public_access == 'Public': print(f'Bucket {bucket.name} has public ownership.') ``` 4. If any buckets have public ownership, use the following Python code to remove the public access: ``` from google.cloud import storage # Replace the following values with your project ID and the path to your JSON key file project_id = 'your-project-id' key_path = '/path/to/your/keyfile.json' # Authenticate with the service account client = storage.Client.from_service_account_json(key_path) # Get a list of all the buckets in the project buckets = client.list_buckets(project=project_id) # Remove public access from any buckets that have it for bucket in buckets: if bucket.iam_configuration.public_access == 'Public': bucket.iam_configuration.public_access = 'None' bucket.patch() print(f'Public access removed from bucket {bucket.name}.') ``` 5. Run the code to remediate the misconfiguration. Verify that the buckets no longer have public ownership by checking their IAM settings in the GCP Console. ```hcl theme={null} resource "google_storage_bucket" "bucket" { name = "BUCKET_NAME" # replace with your bucket name location = "BUCKET_LOCATION" # e.g. "US" storage_class = "STANDARD" } # Grant OWNER-equivalent access only to specific principals, *not* allUsers resource "google_storage_bucket_iam_binding" "bucket_owners" { bucket = google_storage_bucket.bucket.name role = "roles/storage.admin" # or "roles/storage.legacyBucketOwner" if you still use legacy roles members = [ "group:BUCKET_OWNERS_GROUP_EMAIL", # replace with your owners group, e.g. "group:storage-owners@example.com" # add other specific principals as needed, but NEVER "allUsers" or "allAuthenticatedUsers" ] } ``` Remove any existing `google_storage_bucket_iam_binding` or `google_storage_bucket_iam_member` resources that grant an OWNER/`roles/storage.admin`/`roles/storage.legacyBucketOwner` (or similar owner-level) role to `member = "allUsers"`. This IAM change is in-place and does not replace the bucket itself. `terraform plan` should show the offending IAM binding with `member = "allUsers"` being destroyed or updated so that `allUsers` is no longer in the `members` list.