​
Event Information

  • The v1.compute.autoscalers.insert event in GCP for Compute refers to the creation of an autoscaler resource in the Google Compute Engine.
  • Autoscalers are used to automatically adjust the number of instances in a managed instance group based on the workload demand.
  • This event indicates that a new autoscaler has been created, which can be used to dynamically scale the number of instances up or down based on predefined criteria such as CPU utilization or request rate.

​
Examples

  • Unauthorized access: If security is impacted with v1.compute.autoscalers.insert in GCP for Compute, it could potentially allow unauthorized users to create or modify autoscalers, leading to resource misuse or unauthorized access to sensitive data.
  • Resource exhaustion: An impact on security could occur if an attacker abuses the v1.compute.autoscalers.insert API to create a large number of autoscalers, causing resource exhaustion and potentially disrupting the availability of other services.
  • Misconfiguration: If security is impacted with v1.compute.autoscalers.insert in GCP for Compute, it could result in misconfigured autoscalers, leading to performance issues, inefficient resource allocation, or even exposing sensitive information if misconfigured autoscalers inadvertently grant excessive access permissions.

​
Remediation

​
Using Console

To remediate the issues mentioned in the previous response for GCP Compute using the GCP console, you can follow these step-by-step instructions:

  1. Enable VPC Flow Logs:

    • Go to the GCP Console and navigate to the VPC network page.
    • Select the VPC network where you want to enable flow logs.
    • Click on “Edit” at the top of the page.
    • Scroll down to the “Flow logs” section and click on “Enable flow logs”.
    • Configure the desired flow log settings, such as the filter, destination, and sampling rate.
    • Click on “Save” to enable VPC flow logs for the selected VPC network.

  2. Enable CloudTrail for GCP:

    • Go to the GCP Console and navigate to the CloudTrail page.
    • Click on “Create a new trail” to create a new CloudTrail configuration.
    • Provide a name for the trail and select the GCP project where you want to enable CloudTrail.
    • Choose the desired settings for the trail, such as the storage location, log file validation, and event selectors.
    • Click on “Create” to enable CloudTrail for the selected GCP project.

  3. Enable Security Center for GCP:

    • Go to the GCP Console and navigate to the Security Command Center page.
    • Click on “Enable Security Command Center” to enable Security Center for your GCP project.
    • Follow the on-screen instructions to set up Security Center, including enabling the necessary APIs and granting required permissions.
    • Once Security Center is enabled, you can access the Security Command Center dashboard to view and manage security findings and recommendations for your GCP resources.

Please note that the exact steps and options may vary slightly depending on the specific version of the GCP console and the user’s access permissions.

​
Using CLI

To remediate the issues mentioned in the previous response for GCP Compute using GCP CLI, you can follow these steps:

  1. Disable SSH access for the default service account:

    • Use the following command to get the email address of the default service account: 
      gcloud iam service-accounts list --filter="displayName:Compute Engine default service account"
    • Once you have the email address, use the following command to remove the roles associated with SSH access: 
      gcloud projects remove-iam-policy-binding PROJECT_ID --member=serviceAccount:EMAIL_ADDRESS --role=roles/compute.osLogin

  2. Enable VPC Flow Logs for network monitoring:

    • Use the following command to enable VPC Flow Logs for a specific subnet: 
      gcloud compute networks subnets update SUBNET_NAME --region=REGION --enable-flow-logs

  3. Restrict public access to Cloud Storage buckets:

    • Use the following command to update the bucket ACL and remove all public access: 
      gsutil iam ch allUsers:legacyObjectReader gs://BUCKET_NAME

Please note that you need to replace the placeholders (PROJECT_ID, EMAIL_ADDRESS, SUBNET_NAME, REGION, and BUCKET_NAME) with the actual values specific to your GCP environment.

​
Using Python

To remediate the issues mentioned in the previous response for GCP Compute using Python, you can use the following approaches:

  1. Enforce secure OS configurations:

    • Use the google-cloud-sdk library to retrieve the list of GCP Compute instances.
    • Iterate through each instance and check the OS configuration settings.
    • Use the googleapiclient library to update the instance settings and enforce secure configurations.
    • Example Python script: 
      from google.cloud import compute_v1

def enforce_secure_os_config(project_id):
    compute_client = compute_v1.InstancesClient()
    instances = compute_client.list(project=project_id)
    
    for instance in instances:
        # Check OS configuration settings
        if instance.os_config.secure_boot == False:
            # Update instance settings to enforce secure boot
            instance.os_config.secure_boot = True
            compute_client.update(project=project_id, instance=instance)

  2. Implement network security controls:

    • Use the google-cloud-sdk library to retrieve the list of GCP Compute instances.
    • Iterate through each instance and check the network security controls.
    • Use the googleapiclient library to update the instance settings and implement necessary network security controls.
    • Example Python script: 
      from google.cloud import compute_v1

def implement_network_security_controls(project_id):
    compute_client = compute_v1.InstancesClient()
    instances = compute_client.list(project=project_id)
    
    for instance in instances:
        # Check network security controls
        if instance.network_config.firewall_rules == []:
            # Add necessary firewall rules
            firewall_rule = compute_v1.FirewallRule(...)
            compute_client.insert(project=project_id, firewall_rule=firewall_rule)

  3. Enable logging and monitoring:

    • Use the google-cloud-sdk library to retrieve the list of GCP Compute instances.

    • Iterate through each instance and enable logging and monitoring.

    • Use the googleapiclient library to update the instance settings and enable necessary logging and monitoring.

    • Example Python script:

      from google.cloud import compute_v1

def enable_logging_and_monitoring(project_id):
    compute_client = compute_v1.InstancesClient()
    instances = compute_client.list(project=project_id)
    
    for instance in instances:
        # Enable logging and monitoring
        instance.logging_config.enable = True
        instance.monitoring_config.enable = True
        compute_client.update(project=project_id, instance=instance)