​
Event Information

  • The google.bigtable.admin.v2.BigtableInstanceAdmin.CreateCluster event in GCP for Bigtable signifies the creation of a new cluster within a Bigtable instance.
  • This event indicates that a new cluster is being provisioned and configured to store and manage data in Bigtable.
  • It is an important event for monitoring and tracking the creation of clusters in Bigtable, allowing administrators to keep track of the cluster creation process and ensure the successful deployment of new clusters.

​
Examples

  1. Unauthorized access: If security is impacted with the google.bigtable.admin.v2.BigtableInstanceAdmin.CreateCluster operation in GCP for Bigtable, it could potentially allow unauthorized users to create clusters within the Bigtable instance. This could lead to unauthorized access to sensitive data stored in the clusters, compromising the security of the system.

  2. Misconfiguration: If security is impacted with the google.bigtable.admin.v2.BigtableInstanceAdmin.CreateCluster operation in GCP for Bigtable, it could result in misconfigured clusters. Misconfigurations such as weak access controls, improper network settings, or inadequate encryption can create vulnerabilities that can be exploited by attackers, leading to unauthorized access or data breaches.

  3. Lack of encryption: If security is impacted with the google.bigtable.admin.v2.BigtableInstanceAdmin.CreateCluster operation in GCP for Bigtable, it could result in the creation of clusters without proper encryption settings. This can expose sensitive data to potential interception or unauthorized access, compromising the confidentiality and integrity of the data stored in the clusters. It is crucial to ensure that encryption is properly configured for data at rest and in transit to mitigate these risks.

​
Remediation

​
Using Console

  1. Enable VPC Service Controls:

    • Go to the GCP Console and navigate to the VPC Service Controls page.
    • Click on “Create Perimeter” and provide a name for the perimeter.
    • Select the project where your Bigtable instance is located.
    • Choose the desired VPC network and subnet for the perimeter.
    • Click on “Create” to create the perimeter.
    • Once the perimeter is created, click on “Add Access Level” to define the access level for Bigtable.
    • Select the Bigtable API and choose the desired access level.
    • Click on “Add Access Level” to save the access level.
    • Finally, click on “Attach” to attach the perimeter to the project.

  2. Enable Audit Logging:

    • Go to the GCP Console and navigate to the Bigtable instance page.
    • Select the instance for which you want to enable audit logging.
    • Click on “Edit” to edit the instance settings.
    • Scroll down to the “Audit Logging” section and click on “Enable”.
    • Choose the desired log sink, such as Cloud Storage or BigQuery.
    • Configure the log sink settings, such as the bucket or dataset name.
    • Click on “Save” to enable audit logging for the Bigtable instance.

  3. Implement IAM Best Practices:

    • Go to the GCP Console and navigate to the IAM & Admin page.
    • Click on “IAM” to view the IAM roles and permissions.
    • Review the existing IAM roles and identify any unnecessary or overly permissive roles.
    • Remove any unnecessary roles or adjust the permissions of existing roles.
    • Create custom IAM roles if needed to provide more granular access control.
    • Assign the appropriate IAM roles to users or service accounts based on their responsibilities.
    • Regularly review and update the IAM roles and permissions to ensure least privilege access.

​
Using CLI

To remediate the issues mentioned in the previous response for GCP Bigtable using GCP CLI, you can follow these steps:

  1. Enable audit logging for GCP Bigtable:

    • Use the following command to enable audit logging for Bigtable: 
      gcloud logging sinks create [SINK_NAME] bigtable.googleapis.com/projects/[PROJECT_ID]/instances/[INSTANCE_ID] --log-filter='resource.type="bigtable_instance"'
    • Replace [SINK_NAME] with a name for the sink, [PROJECT_ID] with your GCP project ID, and [INSTANCE_ID] with the ID of your Bigtable instance.

  2. Implement VPC Service Controls for Bigtable:

    • Create a VPC Service Controls perimeter for Bigtable using the following command: 
      gcloud access-context-manager perimeters create [PERIMETER_NAME] --resources=bigtable.googleapis.com/projects/[PROJECT_ID]/instances/[INSTANCE_ID] --restricted-services=bigtable.googleapis.com
    • Replace [PERIMETER_NAME] with a name for the perimeter.

  3. Enable encryption at rest for Bigtable:

    • Use the following command to enable encryption at rest for Bigtable: 
      gcloud beta bigtable instances update [INSTANCE_ID] --cluster=[CLUSTER_ID] --encryption-at-rest-state=ENABLED
    • Replace [INSTANCE_ID] with the ID of your Bigtable instance and [CLUSTER_ID] with the ID of your Bigtable cluster.

Please note that the above commands are examples and may need to be modified based on your specific GCP setup. Make sure to refer to the GCP documentation for detailed instructions and additional options.

​
Using Python

To remediate the issues mentioned in the previous response for GCP Bigtable using Python, you can follow these steps:

  1. Enable VPC Service Controls:
    • Use the google-cloud-securitycenter library to enable VPC Service Controls for your Bigtable instance.
    • You can use the update_instance method to update the instance configuration and set the enable_vpc_service_controls parameter to True.
from google.cloud import bigtable

def enable_vpc_service_controls(project_id, instance_id):
    client = bigtable.Client(project=project_id)
    instance = client.instance(instance_id)
    instance.update(enable_vpc_service_controls=True)
  1. Implement IAM Roles and Permissions:
    • Use the google-cloud-iam library to manage IAM roles and permissions for your Bigtable instance.
    • You can use the set_iam_policy method to set the IAM policy for the instance and grant appropriate roles to users or service accounts.
from google.cloud import bigtable_admin_v2

def set_iam_policy(project_id, instance_id, bindings):
    client = bigtable_admin_v2.BigtableInstanceAdminClient()
    instance_name = client.instance_path(project_id, instance_id)
    policy = client.get_iam_policy(request={"resource": instance_name})
    policy.bindings.extend(bindings)
    client.set_iam_policy(request={"resource": instance_name, "policy": policy})
  1. Implement Audit Logging:
    • Use the google-cloud-logging library to enable audit logging for your Bigtable instance.
    • You can use the update_instance method to update the instance configuration and set the enable_logging parameter to True.
from google.cloud import bigtable

def enable_audit_logging(project_id, instance_id):
    client = bigtable.Client(project=project_id)
    instance = client.instance(instance_id)
    instance.update(enable_logging=True)

Please note that the above code snippets are just examples and may need to be modified based on your specific requirements and environment.