​
Event Information

  • The google.bigtable.admin.v2.BigtableInstanceAdmin.DeleteInstance event in GCP for Bigtable indicates that an instance of Bigtable has been deleted.
  • This event signifies that all data and configurations associated with the Bigtable instance have been permanently removed.
  • It is important to note that this event is irreversible and should be executed with caution, as it will result in the loss of all data stored within the Bigtable instance.

​
Examples

  1. Unauthorized deletion: If security is impacted with google.bigtable.admin.v2.BigtableInstanceAdmin.DeleteInstance in GCP for Bigtable, it could potentially allow unauthorized individuals to delete Bigtable instances. This could result in the loss of critical data and disrupt business operations. To mitigate this risk, access controls should be implemented to ensure that only authorized personnel have the necessary permissions to delete Bigtable instances.

  2. Data loss: In the event of a security breach or unauthorized access, an attacker could potentially use the google.bigtable.admin.v2.BigtableInstanceAdmin.DeleteInstance operation to delete Bigtable instances and associated data. This could lead to significant data loss and potential compliance violations. Implementing data backup and disaster recovery mechanisms, such as regular data backups and replication, can help mitigate the impact of such incidents.

  3. Service disruption: If security is compromised and unauthorized individuals gain access to the google.bigtable.admin.v2.BigtableInstanceAdmin.DeleteInstance operation, they could potentially delete critical Bigtable instances, resulting in service disruption for applications relying on those instances. To minimize the impact of such incidents, it is important to implement monitoring and alerting mechanisms to detect any unauthorized access attempts and respond promptly to mitigate the potential service disruption. Additionally, implementing redundancy and failover mechanisms can help ensure high availability and minimize the impact of any service disruptions.

​
Remediation

​
Using Console

  1. Enable VPC Service Controls:

    • Go to the GCP Console and navigate to the VPC Service Controls page.
    • Click on “Create Perimeter” and provide a name for the perimeter.
    • Select the project where your Bigtable instance is located.
    • Choose the desired VPC network and subnet for the perimeter.
    • Click on “Create” to create the perimeter.
    • Once the perimeter is created, click on “Add Access Level” to define the access level for Bigtable.
    • Select the Bigtable API and choose the desired access level.
    • Click on “Add Access Level” to save the access level.
    • Finally, click on “Attach” to attach the perimeter to the project.

  2. Enable Audit Logging:

    • Go to the GCP Console and navigate to the Bigtable instance page.
    • Select the instance for which you want to enable audit logging.
    • Click on “Edit” to edit the instance settings.
    • Scroll down to the “Audit Logging” section and click on “Enable”.
    • Choose the desired log sink, such as Cloud Storage or BigQuery.
    • Configure the log sink settings, such as the bucket or dataset name.
    • Click on “Save” to enable audit logging for the Bigtable instance.

  3. Implement IAM Best Practices:

    • Go to the GCP Console and navigate to the IAM & Admin page.
    • Click on “IAM” to view the IAM roles and permissions.
    • Review the existing IAM roles and identify any unnecessary or overly permissive roles.
    • Remove any unnecessary roles or adjust the permissions of existing roles.
    • Create custom IAM roles if needed to provide more granular access control.
    • Assign the appropriate IAM roles to users or service accounts based on their responsibilities.
    • Regularly review and update the IAM roles and permissions to ensure least privilege access.

​
Using CLI

To remediate the issues mentioned in the previous response for GCP Bigtable using GCP CLI, you can follow these steps:

  1. Enable audit logging for GCP Bigtable:

    • Use the following command to enable audit logging for Bigtable: 
      gcloud logging sinks create [SINK_NAME] bigtable.googleapis.com/projects/[PROJECT_ID]/instances/[INSTANCE_ID] --log-filter='resource.type="bigtable_instance"'
    • Replace [SINK_NAME] with a name for the sink, [PROJECT_ID] with your GCP project ID, and [INSTANCE_ID] with the ID of your Bigtable instance.

  2. Implement VPC Service Controls for Bigtable:

    • Create a VPC Service Controls perimeter for Bigtable using the following command: 
      gcloud access-context-manager perimeters create [PERIMETER_NAME] --resources=bigtable.googleapis.com/projects/[PROJECT_ID]/instances/[INSTANCE_ID] --restricted-services=bigtable.googleapis.com
    • Replace [PERIMETER_NAME] with a name for the perimeter.

  3. Enable encryption at rest for Bigtable:

    • Use the following command to enable encryption at rest for Bigtable: 
      gcloud beta bigtable instances update [INSTANCE_ID] --cluster=[CLUSTER_ID] --encryption-at-rest-state=ENABLED
    • Replace [INSTANCE_ID] with the ID of your Bigtable instance and [CLUSTER_ID] with the ID of your Bigtable cluster.

Please note that the above commands are examples and may need to be modified based on your specific GCP setup and requirements.

​
Using Python

To remediate the issues mentioned in the previous response for GCP Bigtable using Python, you can follow these steps:

  1. Enable VPC Service Controls:

    • Use the google-cloud-securitycenter library to enable VPC Service Controls for your Bigtable instance.
    • Here’s an example Python script to enable VPC Service Controls for Bigtable:
    from google.cloud import securitycenter

client = securitycenter.SecurityCenterClient()

# Set the project ID and Bigtable instance ID
project_id = 'your-project-id'
instance_id = 'your-bigtable-instance-id'

# Enable VPC Service Controls for Bigtable
response = client.update_service_account(
    name=f'projects/{project_id}/locations/global/services/bigtable.googleapis.com',
    service_account='your-service-account-email',
    project=project_id,
    instance=instance_id
)

print('VPC Service Controls enabled for Bigtable')

  2. Implement IAM Roles and Permissions:

    • Use the google-cloud-iam library to assign appropriate IAM roles and permissions to control access to your Bigtable instance.
    • Here’s an example Python script to assign IAM roles and permissions for Bigtable:
    from google.cloud import iam

client = iam.IAMClient()

# Set the project ID and Bigtable instance ID
project_id = 'your-project-id'
instance_id = 'your-bigtable-instance-id'

# Assign IAM roles and permissions for Bigtable
policy = client.get_iam_policy(request={'resource': f'projects/{project_id}/instances/{instance_id}'})
policy.bindings.add(
    role='roles/bigtable.reader',
    members=['user:[email protected]']
)
policy.bindings.add(
    role='roles/bigtable.admin',
    members=['group:[email protected]']
)
client.set_iam_policy(request={'resource': f'projects/{project_id}/instances/{instance_id}', 'policy': policy})

print('IAM roles and permissions assigned for Bigtable')

  3. Implement Audit Logging:

    • Use the google-cloud-logging library to enable audit logging for your Bigtable instance.
    • Here’s an example Python script to enable audit logging for Bigtable:
    from google.cloud import logging_v2

client = logging_v2.LoggingServiceV2Client()

# Set the project ID and Bigtable instance ID
project_id = 'your-project-id'
instance_id = 'your-bigtable-instance-id'

# Enable audit logging for Bigtable
parent = client.project_path(project_id)
client.create_sink(
    request={
        'parent': parent,
        'sink': {
            'name': f'projects/{project_id}/sinks/bigtable-audit-logs',
            'destination': f'bigtable.googleapis.com/projects/{project_id}/instances/{instance_id}',
            'filter': 'logName:"cloudaudit.googleapis.com%2Factivity"',
            'output_version_format': 'V2',
            'include_children': True
        }
    }
)

print('Audit logging enabled for Bigtable')

Please note that you need to replace 'your-project-id', 'your-bigtable-instance-id', 'your-service-account-email', 'user:[email protected]', and 'group:[email protected]' with the actual values specific to your GCP project and Bigtable instance.