​
Event Information

  • The google.bigtable.admin.v2.BigtableInstanceAdmin.DeleteCluster event in GCP for Bigtable indicates that a cluster within a Bigtable instance is being deleted.
  • This event signifies that the specified cluster and all its associated data will be permanently removed from the Bigtable instance.
  • It is important to note that this event should be handled with caution as it can result in data loss if not executed properly.

​
Examples

  1. Unauthorized deletion: If security is impacted with google.bigtable.admin.v2.BigtableInstanceAdmin.DeleteCluster in GCP for Bigtable, it could potentially lead to unauthorized deletion of clusters. This means that an attacker with sufficient privileges could delete critical clusters, resulting in data loss and service disruption.

  2. Data exposure: Another security impact could be the exposure of sensitive data during the deletion process. If proper access controls and encryption mechanisms are not in place, an unauthorized user could gain access to the data stored in the cluster before it is deleted. This could lead to data breaches and compromise the confidentiality of the data.

  3. Service availability: Deleting a cluster without proper planning and coordination can impact the availability of the Bigtable service. If critical clusters are deleted accidentally or without proper backup and recovery mechanisms, it can result in service downtime and affect the availability of applications relying on Bigtable. It is crucial to have proper backup and disaster recovery strategies in place to mitigate this risk.

​
Remediation

​
Using Console

  1. Enable VPC Service Controls:

    • Go to the GCP Console and navigate to the VPC Service Controls page.
    • Click on “Create Perimeter” and provide a name for the perimeter.
    • Select the project where your Bigtable instance is located.
    • Choose the desired VPC network and subnet for the perimeter.
    • Click on “Create” to create the perimeter.
    • Once the perimeter is created, click on “Add Access Level” to define the access level for Bigtable.
    • Select the Bigtable API and choose the desired access level.
    • Click on “Add Access Level” to save the access level.
    • Finally, click on “Attach” to attach the perimeter to the project.

  2. Enable VPC Service Controls for Bigtable API:

    • Go to the GCP Console and navigate to the VPC Service Controls page.
    • Click on “Create Perimeter” and provide a name for the perimeter.
    • Select the project where your Bigtable instance is located.
    • Choose the desired VPC network and subnet for the perimeter.
    • Click on “Create” to create the perimeter.
    • Once the perimeter is created, click on “Add Access Level” to define the access level for Bigtable.
    • Select the Bigtable API and choose the desired access level.
    • Click on “Add Access Level” to save the access level.
    • Finally, click on “Attach” to attach the perimeter to the project.

  3. Enable Private IP for Bigtable instances:

    • Go to the GCP Console and navigate to the Bigtable instances page.
    • Select the desired Bigtable instance.
    • Click on “Edit” to edit the instance settings.
    • Under the “Network” section, select “Private IP” as the network type.
    • Choose the desired VPC network and subnet for the instance.
    • Click on “Save” to save the changes.
    • Once the changes are saved, the Bigtable instance will be accessible only through the private IP within the specified VPC network.

​
Using CLI

To remediate the issues mentioned in the previous response for GCP Bigtable using GCP CLI, you can follow these steps:

  1. Enable audit logging for GCP Bigtable:

    • Use the following command to enable audit logging for Bigtable: 
      gcloud logging sinks create [SINK_NAME] bigtable.googleapis.com/projects/[PROJECT_ID]/instances/[INSTANCE_ID] --log-filter='resource.type="bigtable_instance"'
    • Replace [SINK_NAME] with a name for the sink, [PROJECT_ID] with your GCP project ID, and [INSTANCE_ID] with the ID of your Bigtable instance.

  2. Implement VPC Service Controls for Bigtable:

    • Create a VPC Service Controls perimeter for Bigtable using the following command: 
      gcloud access-context-manager perimeters create [PERIMETER_NAME] --resources=bigtable.googleapis.com/projects/[PROJECT_ID]/instances/[INSTANCE_ID] --restricted-services=bigtable.googleapis.com
    • Replace [PERIMETER_NAME] with a name for the perimeter.

  3. Enable encryption at rest for Bigtable:

    • Use the following command to enable encryption at rest for Bigtable: 
      gcloud beta bigtable instances update [INSTANCE_ID] --cluster=[CLUSTER_ID] --encryption-at-rest-state=ENABLED
    • Replace [INSTANCE_ID] with the ID of your Bigtable instance and [CLUSTER_ID] with the ID of your Bigtable cluster.

Please note that the above commands are examples and may need to be modified based on your specific GCP setup. Make sure to replace the placeholders with the appropriate values.

​
Using Python

To remediate the issues mentioned in the previous response for GCP Bigtable using Python, you can follow these steps:

  1. Enable VPC Service Controls:

    • Use the google-cloud-securitycenter library to enable VPC Service Controls for your Bigtable instance.
    • Here’s an example Python script to enable VPC Service Controls for Bigtable:
    from google.cloud import securitycenter

client = securitycenter.SecurityCenterClient()

# Set the project ID and Bigtable instance ID
project_id = 'your-project-id'
instance_id = 'your-bigtable-instance-id'

# Enable VPC Service Controls for Bigtable
response = client.update_service_account(
    name=f'projects/{project_id}/locations/global/services/bigtable.googleapis.com',
    service_account='your-service-account-email',
    project=project_id,
    instance=instance_id
)

print('VPC Service Controls enabled for Bigtable')

  2. Implement IAM Roles and Permissions:

    • Use the google-cloud-iam library to assign appropriate IAM roles and permissions to users and service accounts.
    • Here’s an example Python script to grant IAM roles for Bigtable:
    from google.cloud import iam

client = iam.IAMClient()

# Set the project ID and Bigtable instance ID
project_id = 'your-project-id'
instance_id = 'your-bigtable-instance-id'

# Grant IAM roles for Bigtable
response = client.set_iam_policy(
    resource=f'projects/{project_id}/instances/{instance_id}',
    policy={
        'bindings': [
            {
                'role': 'roles/bigtable.reader',
                'members': ['user:[email protected]']
            },
            {
                'role': 'roles/bigtable.admin',
                'members': ['serviceAccount:your-service-account-email']
            }
        ]
    }
)

print('IAM roles granted for Bigtable')

  3. Enable Audit Logging:

    • Use the google-cloud-logging library to enable audit logging for your Bigtable instance.
    • Here’s an example Python script to enable audit logging for Bigtable:
    from google.cloud import logging_v2

client = logging_v2.LoggingServiceV2Client()

# Set the project ID and Bigtable instance ID
project_id = 'your-project-id'
instance_id = 'your-bigtable-instance-id'

# Enable audit logging for Bigtable
response = client.update_sink(
    sink_name=f'projects/{project_id}/sinks/bigtable-audit-logs',
    sink={
        'name': f'projects/{project_id}/sinks/bigtable-audit-logs',
        'destination': f'bigtable.googleapis.com/projects/{project_id}/instances/{instance_id}',
        'filter': 'logName:"logs/cloudaudit.googleapis.com%2Factivity"',
        'output_version_format': 'V2'
    }
)

print('Audit logging enabled for Bigtable')

Please note that you need to replace 'your-project-id', 'your-bigtable-instance-id', and 'your-service-account-email' with your actual values in the above scripts.