​
Event Information

  • The google.bigtable.admin.v2.BigtableInstanceAdmin.SetIamPolicy event in GCP for Bigtable refers to a change in the IAM (Identity and Access Management) policy for a Bigtable instance.
  • This event indicates that the IAM policy for a Bigtable instance has been modified, either by adding or removing permissions for a user or service account.
  • The SetIamPolicy event is triggered when there is a request to update the IAM policy of a Bigtable instance, allowing for fine-grained control over who can access and perform actions on the instance.

​
Examples

  1. Unauthorized access: If the SetIamPolicy operation is misconfigured or misused, it can potentially grant unauthorized access to the Bigtable instance. This can lead to unauthorized users gaining access to sensitive data stored in the Bigtable, compromising the security and confidentiality of the data.
  2. Privilege escalation: If the SetIamPolicy operation is not properly restricted or monitored, it can be exploited to escalate privileges within the Bigtable instance. An attacker with limited access can potentially modify the IAM policies to grant themselves higher privileges, allowing them to perform unauthorized actions or access sensitive resources.
  3. Data exposure: If the SetIamPolicy operation is used incorrectly, it can inadvertently expose sensitive data stored in the Bigtable instance. For example, if the IAM policies are not properly configured to restrict access to certain data, unauthorized users may be able to view or modify sensitive information, leading to data breaches or data loss.

​
Remediation

​
Using Console

  1. Enable VPC Service Controls:
    • Go to the GCP Console and navigate to the VPC Service Controls page.
    • Click on “Create Perimeter” and provide a name for the perimeter.
    • Select the project where your Bigtable instance is located.
    • Choose the desired VPC network and subnet for the perimeter.
    • Click on “Create” to create the perimeter.
    • Once the perimeter is created, click on “Add Access Level” to define the access level for Bigtable.
    • Select the Bigtable API and choose the desired access level.
    • Click on “Add Access Level” to save the access level.
    • Finally, click on “Attach” to attach the perimeter to the project.
  2. Implement IAM Roles and Permissions:
    • Go to the IAM & Admin page in the GCP Console.
    • Select the project where your Bigtable instance is located.
    • Click on “Add” to add a new member to the project.
    • Enter the email address of the user or service account that needs access to Bigtable.
    • Select the appropriate IAM role for the user or service account (e.g., Bigtable Admin, Bigtable User).
    • Click on “Save” to grant the IAM role to the user or service account.
  3. Configure Firewall Rules:
    • Go to the VPC Network page in the GCP Console.
    • Select the VPC network where your Bigtable instance is located.
    • Click on “Firewall Rules” and then click on “Create Firewall Rule”.
    • Provide a name for the firewall rule and specify the source IP ranges that should have access to Bigtable.
    • Set the target to “All instances in the network” or specify the specific instances that should have access.
    • Choose the appropriate protocols and ports for Bigtable (e.g., TCP, port 443).
    • Click on “Create” to create the firewall rule.
Note: These instructions assume that you have the necessary permissions to perform these actions in the GCP Console. Make sure to review and adjust the settings based on your specific requirements and security policies.

​
Using CLI

To remediate the issues mentioned in the previous response for GCP Bigtable using GCP CLI, you can follow these steps:
  1. Enable audit logging for GCP Bigtable:
    • Use the following command to enable audit logging for Bigtable: 
      gcloud logging sinks create [SINK_NAME] bigtable.googleapis.com/projects/[PROJECT_ID]/instances/[INSTANCE_ID] --log-filter='resource.type="bigtable_instance"'
    • Replace [SINK_NAME] with a name for the sink, [PROJECT_ID] with your GCP project ID, and [INSTANCE_ID] with the ID of your Bigtable instance.
  2. Implement VPC Service Controls for Bigtable:
    • Create a VPC Service Controls perimeter for Bigtable using the following command: 
      gcloud access-context-manager perimeters create [PERIMETER_NAME] --resources=bigtable.googleapis.com/projects/[PROJECT_ID]/instances/[INSTANCE_ID] --restricted-services=bigtable.googleapis.com
    • Replace [PERIMETER_NAME] with a name for the perimeter, [PROJECT_ID] with your GCP project ID, and [INSTANCE_ID] with the ID of your Bigtable instance.
  3. Configure encryption at rest for Bigtable:
    • Encrypt your Bigtable data at rest by creating a new instance with encryption enabled using the following command: 
      gcloud beta bigtable instances create [INSTANCE_ID] --cluster=[CLUSTER_ID] --cluster-zone=[ZONE] --display-name=[DISPLAY_NAME] --encryption-at-rest-kms-key-name=projects/[PROJECT_ID]/locations/[LOCATION]/keyRings/[KEYRING_NAME]/cryptoKeys/[KEY_NAME]
    • Replace [INSTANCE_ID] with the desired ID for your new instance, [CLUSTER_ID] with the ID of the cluster, [ZONE] with the desired zone, [DISPLAY_NAME] with a name for the instance, [PROJECT_ID] with your GCP project ID, [LOCATION] with the desired location, [KEYRING_NAME] with the name of the key ring, and [KEY_NAME] with the name of the key.
Please note that the above commands are examples and may need to be modified based on your specific requirements and configurations.

​
Using Python

To remediate the issues mentioned in the previous response for GCP Bigtable using Python, you can follow these steps:
  1. Enable VPC Service Controls:
    • Use the google-cloud-bigtable library in Python to create a new Bigtable instance.
    • Set the vpc_service_controls parameter to True while creating the instance.
    • This will enforce VPC Service Controls, ensuring that the Bigtable instance can only be accessed from authorized networks.
  2. Implement IAM Roles and Permissions:
    • Use the google-cloud-iam library in Python to manage IAM roles and permissions for Bigtable.
    • Grant appropriate roles to users or service accounts based on their responsibilities.
    • For example, you can assign the roles/bigtable.admin role to administrators and roles/bigtable.reader role to read-only users.
    • Ensure that the principle of least privilege is followed while assigning roles.
  3. Enable Audit Logging:
    • Use the google-cloud-logging library in Python to enable audit logging for Bigtable.
    • Create a new sink that exports logs to a Cloud Storage bucket or BigQuery dataset.
    • Set the appropriate filter to capture relevant audit events, such as creating or deleting tables, modifying schema, etc.
    • Regularly review the logs to detect any suspicious activities or policy violations.
Please note that the provided steps are high-level guidelines, and you may need to adapt them based on your specific requirements and environment.