Buckets Should Not Allow All Users Reads
More Info:
Ensure that cloud Storage buckets do not allow All Users to Read (“allUsers” must not have “READER” roles)Risk Level
CriticalAddress
SecurityCompliance Standards
NISTTriage and Remediation
Remediation
Using Console
Using Console
To remediate the issue of “Buckets should not allow all users reads” for GCP using GCP console, you can follow these steps:
- Open the GCP Console and go to the Cloud Storage section.
- Select the bucket that you want to remediate.
- Click on the “Permissions” tab.
- Under the “Members” section, find the “allUsers” entry.
- Click on the “Edit” button next to “allUsers”.
- In the “Select a role” dropdown, select “Storage Object Viewer”.
- Click on the “Save” button to save the changes.
- Verify that the “allUsers” entry now has the “Storage Object Viewer” role assigned to it.
Using CLI
Using CLI
To remediate the issue of buckets allowing all users reads in GCP using GCP CLI, follow these steps:Replace [BUCKET_NAME] with the name of the bucket that you identified in step 3.This command will display the current IAM policy for the bucket.
- Open the Cloud Shell in the GCP console.
- Run the following command to list all the buckets in your project:
- Identify the bucket that is allowing all users to read.
- Run the following command to revoke the permissions for all users to read the bucket:
- Verify that the permissions have been revoked by running the following command:
- Check the IAM policy to ensure that only authorized users have access to the bucket.
- Repeat the above steps for all the buckets in your project that are allowing all users to read.
Using Python
Using Python
To remediate the issue of allowing all users to read buckets in GCP using Python, you can follow the below steps:This Python script will remediate the issue of allowing all users to read buckets in GCP by removing the
- First, you need to authenticate with GCP using the service account key. You can create a service account and download the JSON key file from the GCP console.
- Next, you need to import the necessary libraries to interact with GCP Storage.
- Now, create a client object to interact with GCP Storage.
- Get a list of all the buckets in the project.
- For each bucket, check if the
allUsersentity has thestorage.objects.getpermission. If it does, remove the permission.
- Finally, confirm that the
allUsersentity does not have thestorage.objects.getpermission.
storage.objects.get permission for the allUsers entity.