GCP Introduction
GCP Pricing
GCP Threats
GCP Misconfigurations
- Getting Started with GCP Audit
- CloudSql Audit
- Cloud Tasks Monitoring
- Dataflow Monitoring
- Function Monitoring
- Monitoring Compliance
- PubSubLite Monitoring
- Spanner Monitoring
- NoSQL Monitoring
- Compute Audit
- IAM Audit
- BigQuery Monitoring
- CDN Monitoring
- DNS Monitoring
- KMS Monitoring
- Kubernetes Audit
- Load Balancer Monitoring
- Log Monitoring
- Storage Audit
- Pub/Sub Monitoring
- VPC Audit
- IAM Deep Dive
GCP Threats
Cloud Monitoring Should Monitor Storage Object Specific ACL Mutation Count
More Info:
Ensure Cloud Monitoring monitors storage object specific ACL mutation count.
Risk Level
Medium
Address
Security
Compliance Standards
CBP
Triage and Remediation
Remediation
To remediate the misconfiguration “Cloud Monitoring Should Monitor Storage Object Specific ACL Mutation Count” for GCP using the GCP console, follow the steps below:
-
Log in to your GCP console and navigate to the Cloud Storage page.
-
Click on the bucket that you want to monitor.
-
Click on the “Permissions” tab.
-
Review the current IAM policies and ensure that only authorized users or groups have access to the bucket.
-
Click on the “Edit Bucket Permissions” button.
-
Remove any unnecessary or unauthorized users or groups from the IAM policies.
-
Click on the “Add Members” button to add authorized users or groups to the IAM policies.
-
Set the appropriate permissions for each user or group.
-
Click on the “Save” button to save the changes.
-
Navigate to the Cloud Monitoring page.
-
Click on the “Uptime Checks” tab.
-
Click on the “Create Uptime Check” button.
-
Select “Cloud Storage” as the resource type.
-
Enter the bucket name and select the appropriate region.
-
Set the check interval and timeout values.
-
Click on the “Next” button.
-
Set the alerting policy for the uptime check.
-
Click on the “Create” button to create the uptime check.
-
Test the uptime check to ensure that it is monitoring the bucket’s ACL mutation count.
By following these steps, you can remediate the misconfiguration “Cloud Monitoring Should Monitor Storage Object Specific ACL Mutation Count” for GCP using the GCP console.
To remediate the misconfiguration “Cloud Monitoring Should Monitor Storage Object Specific ACL Mutation Count” for GCP using GCP CLI, follow the below steps:
-
Open the Google Cloud Console and select the project in which the storage bucket is located.
-
Open the Cloud Shell by clicking on the icon in the top right-hand corner of the console.
-
Run the following command to enable the Cloud Storage API:
gcloud services enable storage-api.googleapis.com
- Run the following command to create a metric descriptor for tracking ACL mutations:
gcloud beta monitoring metric-descriptors create \
--type=custom.googleapis.com/storage/object/iam_mutation_count \
--description="Count of mutations to a storage object's IAM policy" \
--metric-kind=DELTA \
--value-type=INT64 \
--display-name="Storage Object IAM Mutation Count"
- Run the following command to create a log-based metric for tracking ACL mutations:
gcloud beta logging metrics create storage-object-iam-mutation-count \
--description="Count of mutations to a storage object's IAM policy" \
--log-filter='resource.type="gcs_bucket" AND protoPayload.methodName="storage.objects.update" AND protoPayload.request.updateMask.fieldPaths:"acl"' \
--metric-descriptors=custom.googleapis.com/storage/object/iam_mutation_count
- Run the following command to create an alert policy for monitoring the log-based metric:
gcloud alpha monitoring policies create \
--display-name="Storage Object IAM Mutation Count Alert" \
--condition-exit-code=0 \
--condition-filter='metric.type="logging.googleapis.com/user/storage-object-iam-mutation-count" AND metric.label."bucket_name"="my-bucket"' \
--notification-channels=CHANNEL_ID \
--combiner=OR \
--duration=300s \
--comparison=COMPARISON_GT \
--threshold-value=1
Note: Replace “my-bucket” with the name of the storage bucket you want to monitor and replace “CHANNEL_ID” with the ID of the notification channel you want to use.
- Verify that the alert policy is created successfully by running the following command:
gcloud alpha monitoring policies list
Now, you have successfully remediated the misconfiguration “Cloud Monitoring Should Monitor Storage Object Specific ACL Mutation Count” for GCP using GCP CLI.
To remediate the misconfiguration of not monitoring the storage object-specific ACL mutation count in GCP, you can follow these steps using Python:
- Install the required libraries:
pip install google-cloud-storage
pip install google-auth
-
Create a service account and download the JSON key file.
-
Set the environment variable
GOOGLE_APPLICATION_CREDENTIALSto the path of the JSON key file. -
Use the following Python code to get the list of all buckets in your GCP project:
from google.cloud import storage
client = storage.Client()
buckets = client.list_buckets()
for bucket in buckets:
print(bucket.name)
- Use the following Python code to get the list of all objects in a bucket:
from google.cloud import storage
client = storage.Client()
bucket = client.get_bucket('bucket-name')
blobs = bucket.list_blobs()
for blob in blobs:
print(blob.name)
- Use the following Python code to get the ACL of a storage object:
from google.cloud import storage
client = storage.Client()
bucket = client.get_bucket('bucket-name')
blob = bucket.get_blob('object-name')
acl = blob.acl
for entry in acl:
print(entry)
- Use the following Python code to update the ACL of a storage object:
from google.cloud import storage
client = storage.Client()
bucket = client.get_bucket('bucket-name')
blob = bucket.get_blob('object-name')
acl = blob.acl
# Add a new entry to the ACL
entry = storage.acl.Entity('user-email', 'user')
acl.add_entity(entry)
acl.save()
- Finally, you can use the above Python code snippets to monitor the storage object-specific ACL mutation count and take appropriate actions if the count exceeds a certain threshold.
Note: It is important to ensure that the service account used has sufficient permissions to access the required resources.