Restricting the Use of Images
More Info:
Ensure that only images from trusted Google Cloud Platform (GCP) projects are allowed as the source for boot disks for new virtual machine instances. To enforce this constraint, enable and configure the “Define Trusted Image Projects” policy at the GCP organization level.Risk Level
MediumAddress
Operational Maturity, Reliability, SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of restricting the use of images in GCP using GCP console, follow these steps:
- Open the GCP console and select the project where the misconfiguration exists.
- Click on the “Navigation menu” button (☰) in the top-left corner of the console.
- Navigate to the “Compute Engine” section and click on “Images”.
- Select the image that needs to be restricted and click on the “Edit” button at the top of the page.
- In the “Permissions” section, click on the “Add item” button.
- In the “New permission” window, enter the email address of the user or group that should have access to the image.
- Select the “Compute Image User” role from the “Select a role” dropdown menu.
- Click on the “Save” button to add the new permission.
- Repeat steps 5-8 for each user or group that should have access to the image.
- Click on the “Save” button at the bottom of the page to save the changes.
Using CLI
Using CLI
To remediate the misconfiguration of restricting the use of images in GCP, you can follow the below steps using GCP CLI:Replace [IMAGE-NAME] with the name of the image that you want to delete and [PROJECT-ID] with the ID of your GCP project.Replace [ORGANIZATION-ID] with the ID of your GCP organization.Save the file.
- Open the Cloud Shell from the GCP console.
- Run the following command to list all the images in your project:
- Identify the images that are not required and need to be deleted.
- Run the following command to delete the image:
- Repeat step 4 for all the images that you want to delete.
- Once all the unnecessary images are deleted, you can create a policy to restrict the use of images. Run the following command to create a policy:
- In the above command, the policy is created using a YAML file named boolean_policy.yaml. Create this file with the following content:
- Run the following command to update the policy:
- The policy is now enforced and any user who tries to use an image that is not allowed will receive an error message.
Using Python
Using Python
To remediate the misconfiguration of restricting the use of images in GCP using Python, you can follow the below steps:By following the above steps, you can remediate the misconfiguration of restricting the use of images in GCP using Python.
- Firstly, you need to create a service account in the GCP project with the required permissions to manage the images. You can use the following command to create a service account:
- After creating the service account, you need to grant it the required permissions to manage the images. You can use the following command to grant the required permissions:
- Next, you need to create a custom IAM role that restricts the use of images. You can use the following Python code to create a custom IAM role:
- After creating the custom IAM role, you need to assign it to the service account that you created in step 1. You can use the following Python code to assign the custom IAM role to the service account:
- Finally, you need to verify that the custom IAM role has been assigned to the service account and that the service account has the required permissions to manage the images. You can use the following command to verify the same: