​
Event Information

  • The google.bigtable.admin.v2.BigtableInstanceAdmin.CreateInstance event in GCP for Bigtable refers to the creation of a new Bigtable instance.
  • This event indicates that a user or an automated process has initiated the creation of a new Bigtable instance in the Google Cloud Platform.
  • The event provides information about the instance name, project ID, and other relevant details required for the creation process.

​
Examples

  1. Unauthorized access: If security is impacted with google.bigtable.admin.v2.BigtableInstanceAdmin.CreateInstance in GCP for Bigtable, it could potentially allow unauthorized users to create new Bigtable instances. This can lead to unauthorized access to sensitive data stored in Bigtable, compromising the confidentiality and integrity of the data.

  2. Inadequate authentication and authorization: If security is impacted with google.bigtable.admin.v2.BigtableInstanceAdmin.CreateInstance in GCP for Bigtable, it may indicate that the authentication and authorization mechanisms are not properly implemented. This can result in unauthorized users being able to create Bigtable instances, bypassing the necessary access controls and permissions.

  3. Lack of encryption: If security is impacted with google.bigtable.admin.v2.BigtableInstanceAdmin.CreateInstance in GCP for Bigtable, it could mean that the data stored in the newly created instances is not properly encrypted. This can expose sensitive data to potential attackers, increasing the risk of data breaches and unauthorized access to the data. It is important to ensure that encryption is enforced for data at rest and in transit to mitigate this risk.

​
Remediation

​
Using Console

  1. Enable VPC Service Controls:

    • Go to the GCP Console and navigate to the VPC Service Controls page.
    • Click on “Create Perimeter” and provide a name for the perimeter.
    • Select the project where your Bigtable instance is located.
    • Choose the desired VPC network and subnet for the perimeter.
    • Click on “Create” to create the perimeter.
    • Once the perimeter is created, click on “Add Access Level” to define the access level for Bigtable.
    • Select the Bigtable API and choose the desired access level.
    • Click on “Add Access Level” to save the access level.
    • Finally, click on “Attach” to attach the perimeter to your project.

  2. Implement IAM Roles and Permissions:

    • Go to the IAM & Admin page in the GCP Console.
    • Click on “IAM” to view the IAM roles and permissions.
    • Click on “Add” to add a new IAM role.
    • Select the desired role for Bigtable, such as “Bigtable Admin” or “Bigtable User”.
    • Enter the email address of the user or service account that needs the role.
    • Click on “Save” to assign the role to the user or service account.

  3. Enable Audit Logging:

    • Go to the GCP Console and navigate to the Logging page.
    • Click on “Create Sink” to create a new log sink.
    • Provide a name for the sink and select the desired Bigtable instance.
    • Choose the log entries you want to export, such as “Admin Activity” or “Data Access”.
    • Select the destination for the logs, such as Cloud Storage or BigQuery.
    • Configure any additional settings, such as filter or format options.
    • Click on “Create Sink” to create the log sink.
    • Once the sink is created, the logs will be exported to the specified destination for further analysis and monitoring.

​
Using CLI

To remediate the issues mentioned in the previous response for GCP Bigtable using GCP CLI, you can follow these steps:

  1. Enable audit logging for GCP Bigtable:

    • Use the following command to enable audit logging for Bigtable: 
      gcloud logging sinks create [SINK_NAME] bigtable.googleapis.com/projects/[PROJECT_ID]/instances/[INSTANCE_ID] --log-filter='resource.type="bigtable_instance"'
    • Replace [SINK_NAME] with a name for the sink, [PROJECT_ID] with your GCP project ID, and [INSTANCE_ID] with the ID of your Bigtable instance.

  2. Implement VPC Service Controls for Bigtable:

    • Create a VPC Service Controls perimeter for Bigtable using the following command: 
      gcloud access-context-manager perimeters create [PERIMETER_NAME] --resources=bigtable.googleapis.com/projects/[PROJECT_ID]/instances/[INSTANCE_ID] --restricted-services=bigtable.googleapis.com
    • Replace [PERIMETER_NAME] with a name for the perimeter.

  3. Enable encryption at rest for Bigtable:

    • Use the following command to enable encryption at rest for Bigtable: 
      gcloud beta bigtable instances update [INSTANCE_ID] --cluster=[CLUSTER_ID] --encryption-at-rest-state=ENABLED
    • Replace [INSTANCE_ID] with the ID of your Bigtable instance and [CLUSTER_ID] with the ID of your Bigtable cluster.

Please note that the above commands are examples and may need to be modified based on your specific GCP setup. Make sure to replace the placeholders with the appropriate values.

​
Using Python

To remediate the issues mentioned in the previous response for GCP Bigtable using Python, you can follow these steps:

  1. Enable VPC Service Controls:
    • Use the google-cloud-securitycenter library to enable VPC Service Controls for your Bigtable instance.
    • You can use the update_instance method to update the instance configuration and set the enable_vpc_service_controls parameter to True.
from google.cloud import bigtable

def enable_vpc_service_controls(project_id, instance_id):
    client = bigtable.Client(project=project_id)
    instance = client.instance(instance_id)
    instance.update(enable_vpc_service_controls=True)
  1. Implement IAM Roles and Permissions:
    • Use the google-cloud-iam library to manage IAM roles and permissions for your Bigtable instance.
    • You can use the set_iam_policy method to set the IAM policy for the instance and grant appropriate roles to users or service accounts.
from google.cloud import bigtable_admin_v2

def set_iam_policy(project_id, instance_id, bindings):
    client = bigtable_admin_v2.BigtableInstanceAdminClient()
    instance_name = client.instance_path(project_id, instance_id)
    policy = client.get_iam_policy(request={"resource": instance_name})
    policy.bindings.extend(bindings)
    client.set_iam_policy(request={"resource": instance_name, "policy": policy})
  1. Implement Audit Logging:
    • Use the google-cloud-logging library to enable audit logging for your Bigtable instance.
    • You can use the update_instance method to update the instance configuration and set the enable_logging parameter to True.
from google.cloud import bigtable

def enable_audit_logging(project_id, instance_id):
    client = bigtable.Client(project=project_id)
    instance = client.instance(instance_id)
    instance.update(enable_logging=True)

Please note that the above code snippets are just examples and may need to be modified based on your specific requirements and environment.