Cloud Monitoring Should Monitor Storage ACL Operations Count
More Info:
Ensure Cloud Monitoring monitors storage ACL operations count.Risk Level
MediumAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of not monitoring Storage ACL Operations Count in GCP using GCP console, please follow the below steps:
- Open the GCP console and select the desired project in which the storage bucket is located.
- Navigate to the Cloud Storage section from the left-hand menu.
- Select the storage bucket for which you want to enable monitoring of ACL operations count.
- Click on the “Edit bucket permissions” button located at the top of the page.
- In the “Bucket Permissions” section, click on the “Add members” button.
- Enter the email address of the user or service account that will be responsible for monitoring the Storage ACL Operations Count.
- Select the “Storage Legacy Bucket Reader” role from the “Select a role” dropdown menu.
- Click on the “Add” button to add the user or service account to the bucket permissions.
- Once the user or service account has been added, navigate to the “Monitoring” section of the storage bucket.
- In the “Monitoring” section, click on the “Create Policy” button.
- Enter a name for the policy and select the “Metric” option.
- In the “Filter” section, select the “Storage > Bucket” option from the dropdown menu.
- Select the storage bucket for which you want to monitor the ACL operations count.
- In the “Condition” section, select the “Metric Threshold” option.
- Set the threshold value for the ACL operations count and select the time interval for which you want to monitor the metric.
- Click on the “Save” button to save the policy.
Using CLI
Using CLI
To remediate the misconfiguration of not monitoring Storage ACL operations count in GCP using GCP CLI, you can follow the below steps:
- Open the Cloud Shell in the GCP console.
-
Run the following command to create a new bucket in the project:
-
Run the following command to enable logging for the bucket:
Replace
<bucket-name>with the name of the bucket that you created in step 2, and<log-bucket-name>and<log-object-prefix>with the name of the bucket and object prefix where you want to store the logs. -
Run the following command to create a new sink for the logs:
Replace
<sink-name>with a name for the new sink, and<bucket-name>with the name of the bucket that you created in step 2. -
Run the following command to grant the
logging.logWriterrole to the sink service account:Replace<project-id>with the ID of the project that contains the bucket, and<sink-service-account>with the email address of the service account that was created for the sink. -
Verify that the sink is working correctly by updating the IAM policy for the bucket:
-
Check the logs in the log bucket to verify that the sink is working correctly:
This should show a log entry for the IAM policy update that you performed in step 6.
Using Python
Using Python
To remediate the misconfiguration “Cloud Monitoring Should Monitor Storage ACL Operations Count” for GCP using Python, follow these steps:Replace the placeholders
- Open the Google Cloud Console and select the project where the storage bucket is located.
- Go to the Cloud Storage section.
- Find the bucket that needs to be monitored and click on it.
- Click on the “Permissions” tab.
- Click on the “Add Members” button.
- Add the service account that will be used for monitoring. This service account must have the Cloud Monitoring Agent role.
- Click on the “Add” button.
- Open the Cloud Shell from the Google Cloud Console.
-
Install the Google Cloud Storage Python library by running the following command:
- Create a Python script that will monitor the ACL operations count for the storage bucket. Here’s an example script:
<path-to-service-account-key>, <project-name>, and <bucket-name> with the actual values.-
Save the Python script and run it from the Cloud Shell by running the following command:
Replace
<script-name>with the actual name of the Python script. - Verify that the metric is being collected by going to the Cloud Monitoring section of the Google Cloud Console and checking that the metric is listed under the “Metrics Explorer” tab.