Pubsublite subscription delivery requirement set remediation

Using Console

To remediate the PubSub Lite Delivery Requirement misconfiguration in GCP, you can follow these steps:

Log in to the GCP console and navigate to the Pub/Sub Lite section.
Select the topic for which you want to set the delivery requirement.
Click on the “Delivery Requirement” tab.
In the “Delivery Requirement” section, select the desired delivery requirement from the dropdown menu.
Click “Save” to apply the changes.

Note: The available delivery requirements are “At least once” and “Exactly once”. Selecting “At least once” means that messages will be delivered at least once, but may be duplicated. Selecting “Exactly once” means that messages will be delivered exactly once, but may require additional configuration and may result in higher latency.

Using CLI

The PubSub Lite Delivery Requirement should be set to ensure that messages are delivered to at least two independent zones within a region. Here are the steps to remediate this misconfiguration for GCP using GCP CLI:

Open the Google Cloud Console and navigate to the Pub/Sub Lite topic that needs to be remediated.
Click on the “Edit” button to edit the topic configuration.
In the “Delivery” section, select “At least two zones” from the drop-down menu.
Click on the “Save” button to save the changes.

Alternatively, you can use the following GCP CLI command to set the delivery requirement for a Pub/Sub Lite topic:

gcloud pubsub lite-topics update [TOPIC_NAME] --delivery-requirement=2

Replace [TOPIC_NAME] with the name of the Pub/Sub Lite topic that needs to be remediated. This command sets the delivery requirement to at least two zones within the region.

Using Python

The Pub/Sub Lite delivery requirement should be set to ensure that messages are delivered at least once. To remediate this issue in GCP using Python, follow these steps:

Install the Google Cloud Pub/Sub Lite client library for Python by running the following command in your terminal or command prompt:

pip install google-cloud-pubsublite

Import the necessary libraries and create a client object for Pub/Sub Lite:

from google.cloud.pubsublite import AdminClient, SubscriptionPath, Subscription
from google.cloud.pubsublite.types import SubscriptionDeliveryConfig, DeliveryRequirement

# Replace <project-id> and <region> with your project ID and region, respectively.
project_id = "<project-id>"
region = "<region>"
client = AdminClient()
subscription_path = SubscriptionPath(project_id, region, "<subscription-name>")

Get the current subscription configuration:

subscription = client.get_subscription(subscription_path)

Set the delivery requirement to DeliveryRequirement.DELIVER_AFTER_STORED:

delivery_config = SubscriptionDeliveryConfig(
    delivery_requirement=DeliveryRequirement.DELIVER_AFTER_STORED
)
subscription.delivery_config = delivery_config

Update the subscription with the new configuration:

client.update_subscription(subscription)

After completing these steps, your Pub/Sub Lite subscription will have the correct delivery requirement set.

Using Terraform

resource "google_pubsub_lite_subscription" "PUBSUB_LITE_SUBSCRIPTION_NAME" {
  name   = "projects/PROJECT_ID/locations/ZONE/subscriptions/SUBSCRIPTION_ID"
  topic  = "projects/PROJECT_ID/locations/ZONE/topics/TOPIC_ID"

  # Set the delivery requirement as required by your policy:
  # - "DELIVER_IMMEDIATELY"      → best effort, may deliver before storage
  # - "DELIVER_AFTER_STORED"     → only after message is successfully stored
  delivery_config {
    delivery_requirement = "DELIVER_AFTER_STORED"
  }
}

Replace:

PROJECT_ID with your GCP project ID.
ZONE with the Pub/Sub Lite location/zone.
SUBSCRIPTION_ID with the subscription name.
TOPIC_ID with the Pub/Sub Lite topic name.
DELIVER_AFTER_STORED with DELIVER_IMMEDIATELY if that is your required threshold.

This change is an in-place update for existing Pub/Sub Lite subscriptions (no forced replacement expected).Verification: terraform plan should show a single in-place update on google_pubsub_lite_subscription.PUBSUB_LITE_SUBSCRIPTION_NAME changing delivery_config.0.delivery_requirement from null (or the old value) to the configured value.

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

Pubsublite subscription delivery requirement set remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation