Retention Policy Must Be Locked with a Specified Minimum Duration
More Info:
Buckets must have a Retention Policy Configured along with a Retention Period, that is specified by the User (must be greater than 0)Risk Level
LowAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the retention policy misconfiguration in GCP using the GCP console, follow these steps:
- Open the GCP console and navigate to the Cloud Storage section.
- Click on the bucket that you want to remediate.
- Click on the “Edit Bucket” button at the top of the page.
- Scroll down to the “Retention Policy” section.
- Click on the “Add Retention Policy” button.
- Set the “Minimum retention period” to the desired duration.
- Check the “Locked” checkbox to prevent any changes to the retention policy.
- Click on the “Save” button to apply the changes.
- Verify that the retention policy has been successfully applied by checking the “Retention Policy” section.
Using CLI
Using CLI
To remediate the retention policy misconfiguration for GCP using GCP CLI, follow these steps:
- Open the GCP console and go to the Cloud Storage section.
- Identify the bucket that has the misconfigured retention policy.
- Open the Cloud Shell from the top right corner of the GCP console.
-
Run the following command to set the retention policy for the identified bucket:
Replace
<duration>with the minimum duration for which the retention policy must be locked, and<bucket-name>with the name of the bucket that needs to be remediated. -
Verify that the retention policy has been set correctly by running the following command:
This command should return the minimum duration for which the retention policy has been set.
- If required, repeat the above steps for any other buckets that have the same misconfiguration.
Using Python
Using Python
To remediate the retention policy misconfiguration for GCP using Python, follow these steps:This code will check the current retention policy for the specified log, and update it if necessary to ensure that the retention policy is locked with a specified minimum duration of 1 week (604800 seconds).
- Import the necessary libraries:
- Set the project ID and log name:
- Create a Logging client:
- Get the current retention policy for the log:
- Set the minimum retention duration:
- Check if the current retention duration is less than the minimum duration:
- If the retention duration is already greater than or equal to the minimum duration, no action is needed.