Ensure Access Approval Is Enabled

Using Console

To remediate the “Ensure Access Approval Is Enabled” misconfiguration in GCP using the GCP console, please follow the below steps:

Log in to the GCP console with your credentials.
Navigate to the “Access Approval” page by clicking on the hamburger menu in the top left corner and selecting “Security” > “Access Approval”.
Click on the “Enable Access Approval” button.
Configure the access approval settings as per your organization’s policies.
Click on the “Save” button to save the changes.

Once you have completed these steps, access approval will be enabled for your GCP organization, and any requests for access to resources will need to be approved before they are granted.

Using CLI

To remediate the misconfiguration “Ensure Access Approval Is Enabled” in GCP using GCP CLI, follow the below steps:Step 1: Open the Cloud Shell in your GCP console.Step 2: Run the following command to check if Access Approval is enabled or not:

gcloud access-approval settings describe

Step 3: If the output of the above command shows that Access Approval is not enabled, then run the following command to enable it:

gcloud access-approval settings update --enforce-on-approval=true

Step 4: After running the above command, Access Approval will be enabled and any requests for access to resources in your GCP project will require approval before they can be granted.Step 5: Verify that Access Approval is enabled by running the following command:

gcloud access-approval settings describe

Step 6: The output of the above command should show that Access Approval is enabled and enforced.With these steps, you have successfully remediated the misconfiguration “Ensure Access Approval Is Enabled” in GCP using GCP CLI.

Using Python

To remediate the misconfiguration “Ensure Access Approval Is Enabled” in GCP using Python, you can follow the below steps:

Import the necessary libraries:

from google.cloud import accessapproval_v1
from google.oauth2 import service_account

Create a service account and grant it the necessary permissions to access the Access Approval API.

credentials = service_account.Credentials.from_service_account_file('path/to/service_account.json')
client = accessapproval_v1.AccessApprovalClient(credentials=credentials)

Get the current Access Approval settings:

response = client.get_access_approval_settings(request={"name": "projects/<project_id>/accessApprovalSettings"})

Check if Access Approval is enabled or not:

if response.enforcement_mode == accessapproval_v1.EnforcementMode.ENFORCEMENT_MODE_UNSPECIFIED:
    response.enforcement_mode = accessapproval_v1.EnforcementMode.ENFORCEMENT_MODE_ENABLED
    response = client.update_access_approval_settings(request={"access_approval_settings": response})

If Access Approval is not enabled, enable it:

response.enforcement_mode = accessapproval_v1.EnforcementMode.ENFORCEMENT_MODE_ENABLED
response = client.update_access_approval_settings(request={"access_approval_settings": response})

Verify that Access Approval is enabled:

if response.enforcement_mode == accessapproval_v1.EnforcementMode.ENFORCEMENT_MODE_ENABLED:
    print("Access Approval is enabled.")
else:
    print("Failed to enable Access Approval.")

Note: Replace <project_id> with your actual project ID.These steps will ensure that Access Approval is enabled in GCP using Python.

Using Terraform

resource "google_access_approval_settings" "logging_project" {
  # Substitute with your Logging project ID (e.g. "my-logging-project")
  project_id = "LOGGING_PROJECT_ID"

  enrolled_services {
    # Enable Access Approval for Cloud Logging
    cloud_product    = "logging.googleapis.com"
    enrollment_level = "FULL"
  }

  # Optional: add emails that must be notified/approve requests
  # notification_emails = ["SECURITY_TEAM_EMAIL@example.com"]
}

This change does not replace the project; it just configures Access Approval for it.To verify, terraform plan should show a new google_access_approval_settings.logging_project resource (or an update) with enrolled_services.cloud_product = "logging.googleapis.com" and enrollment_level = "FULL".

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

Ensure Access Approval Is Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: