Storage Buckets Should Have A Retention Policy Defined
More Info:
Storage Buckets should have a retention policy defined to add an extra layer of protection, for instance, to assist recovery in case of an accidental deletion.Risk Level
LowAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
Sure, here are the step by step instructions to remediate the storage bucket retention policy misconfiguration in GCP using the GCP console:
- Open the GCP console and navigate to the Cloud Storage section.
- Select the bucket for which you want to set the retention policy.
- Click on the “Edit bucket retention” button at the top of the page.
- In the “Retention period” section, select the desired retention period for the bucket. Note: The retention period specifies how long objects in the bucket must be retained before they can be deleted.
- Select the “Locked” option to prevent the retention policy from being removed or reduced. Note: This is an optional step, but it is recommended to prevent accidental removal of the retention policy.
- Click the “Save” button to apply the retention policy to the bucket.
Using CLI
Using CLI
To remediate the misconfiguration “Storage Buckets Should Have A Retention Policy Defined” in GCP using GCP CLI, follow the below steps:
- Open the Cloud Shell in your GCP console.
-
Run the following command to list all the storage buckets in your GCP project:
- Identify the bucket for which you want to define the retention policy.
-
Run the following command to set the retention policy for the identified bucket:
Replace
<retention_period>with the duration for which you want to retain the objects in the bucket. For example, if you want to retain the objects in the bucket for 365 days, then you can set the retention period to 1 year. You can specify the retention period in seconds, minutes, hours, days, months, or years. For example, to set the retention period to 1 year, you can use the following command:Replace<bucket_name>with the name of the bucket for which you want to set the retention policy. -
Verify the retention policy by running the following command:
This command will display the retention policy for the specified bucket.
- Repeat the above steps for all the storage buckets in your GCP project to ensure that all the buckets have a retention policy defined.
Using Python
Using Python
To remediate the misconfiguration of storage buckets not having a retention policy defined in GCP using Python, you can follow the below steps:
-
First, you need to install the Google Cloud Storage module for Python. You can install it using the following command:
-
Next, you need to authenticate with GCP using a service account. You can create a service account and download its JSON key file from the GCP console. Then, you can set the
GOOGLE_APPLICATION_CREDENTIALSenvironment variable to the path of the JSON key file. -
After that, you need to list all the buckets in your GCP project. You can do this using the following code:
-
Once you have the list of all the buckets, you can set a retention policy for each bucket using the
Bucketclass in thegoogle-cloud-storagemodule. You can set the retention policy to a specific number of days using theretention_periodparameter.In the above example, the retention policy is set to 30 days for all the buckets. You can change the value ofretention_periodas per your requirement. -
Finally, you can verify that the retention policy has been set for each bucket by listing the bucket metadata and checking the
retentionPolicyfield.The above code will print the retention policy for each bucket.