Principals with Infrastructure modification capabilities
More Info:
Minimize or restrict principals which can modify infrastructure.Risk Level
MediumAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Principals with Infrastructure modification capabilities” in GCP using the GCP console, follow these steps:
- Open the GCP console by visiting the GCP Console URL (console.cloud.google.com) and logging in with your GCP account credentials.
- In the GCP console, navigate to the IAM & Admin page by clicking on the navigation menu icon (☰) in the top-left corner and selecting “IAM & Admin” under the “IAM” section.
- On the IAM & Admin page, you will see a list of IAM roles and permissions. Review the existing roles and identify any roles that grant infrastructure modification capabilities (e.g., roles like “Editor” or “Owner”).
- Click on the role that you want to modify, such as the “Editor” role, to view its details.
- In the role details, click on the “Permissions” tab to see the list of permissions associated with the role.
- Review the permissions and identify any permissions that grant infrastructure modification capabilities. For example, permissions like “compute.instances.create” or “compute.instances.delete” allow the creation or deletion of instances.
- To remediate the misconfiguration, you have two options: a. Remove the problematic role from the user or service account: If you find a user or service account assigned to the role with infrastructure modification capabilities, click on the “Members” tab in the role details. Locate the user or service account and click on the “X” icon next to their name to remove the role assignment. b. Modify the role’s permissions: If you want to keep the role but remove specific infrastructure modification permissions, click on the “Edit” button at the top of the role details page. In the permissions list, uncheck the checkboxes next to the permissions that grant infrastructure modification capabilities. Click “Save” to apply the changes.
- Repeat steps 4-7 for any other roles that grant infrastructure modification capabilities.
- Once you have remediated all the roles, review the remaining roles to ensure that only necessary permissions are assigned to each role.
Using CLI
Using CLI
To remediate the misconfiguration of “Principals with Infrastructure modification capabilities” in GCP using the GCP CLI, follow these step-by-step instructions:
- Install and set up the GCP CLI by following the official documentation: https://cloud.google.com/sdk/docs/install
-
Authenticate with your GCP account by running the following command in your terminal:
-
Once authenticated, set your desired GCP project as the default project by executing the following command:
Replace “PROJECT_ID” with the actual ID of your GCP project.
-
List the IAM policies of your project to identify the principals with infrastructure modification capabilities. Run the following command:
Replace “PROJECT_ID” with your GCP project’s ID.
- Review the output of the previous command and identify the principals that have excessive permissions for infrastructure modification. Note down the email addresses or service account names of these principals.
-
Remove the infrastructure modification capabilities from the identified principals by updating the project’s IAM policy. Run the following command:
Replace “PROJECT_ID” with your GCP project’s ID. “/path/to/updated/iam-policy.json” should be the path to a JSON file that contains the updated IAM policy. You can create this file by modifying the existing IAM policy JSON and removing the excessive permissions from the identified principals.
- After executing the command, the IAM policy of your GCP project will be updated, removing the infrastructure modification capabilities from the identified principals.
-
Verify the changes by running the following command to list the updated IAM policies:
Ensure that the identified principals no longer have the excessive permissions for infrastructure modification.
Using Python
Using Python
To remediate the misconfiguration of “Principals with Infrastructure modification capabilities” in GCP using Python, follow these step-by-step instructions:
-
Install the necessary libraries:
- Install the Google Cloud SDK by following the instructions provided in the official documentation: https://cloud.google.com/sdk/docs/install
- Install the
google-cloud-iamlibrary by running the following command:
-
Authenticate with your GCP account:
- Run the following command and follow the instructions to authenticate with your GCP account:
- Run the following command and follow the instructions to authenticate with your GCP account:
-
Create a Python script and import the required libraries:
-
Define the necessary variables:
- Replace
[PROJECT_ID]with your GCP project ID. - Replace
[SERVICE_ACCOUNT_EMAIL]with the email address of the service account that has infrastructure modification capabilities. - Replace
[NEW_ROLE]with the desired role that limits the infrastructure modification capabilities.
- Replace
-
Create a function to update the IAM policy of the service account:
-
Call the function to update the IAM policy:
-
Save and run the Python script:
- Save the script with a
.pyextension (e.g.,remediate_iam.py). - Open a terminal or command prompt and navigate to the directory where the script is saved.
- Run the following command to execute the script:
- Save the script with a