​
Event Information

  • The google.bigtable.admin.v2.BigtableInstanceAdmin.PartialUpdateCluster event in GCP for Bigtable refers to an update operation performed on a Bigtable cluster within a Bigtable instance.
  • This event indicates that a partial update was made to the configuration of a Bigtable cluster, such as modifying its storage type, CPU, or memory allocation.
  • It is important to monitor this event as it provides visibility into any changes made to the cluster configuration, allowing administrators to track and audit modifications to the Bigtable cluster setup.

​
Examples

  1. Unauthorized access: If security is impacted with google.bigtable.admin.v2.BigtableInstanceAdmin.PartialUpdateCluster in GCP for Bigtable, it could potentially allow unauthorized users to modify or update the cluster configuration. This can lead to unauthorized access to sensitive data stored in the Bigtable cluster.

  2. Data integrity: If security is impacted with google.bigtable.admin.v2.BigtableInstanceAdmin.PartialUpdateCluster in GCP for Bigtable, it may result in data integrity issues. Unauthorized modifications to the cluster configuration can lead to data corruption or loss, compromising the reliability and accuracy of the data stored in the Bigtable cluster.

  3. Compliance violations: If security is impacted with google.bigtable.admin.v2.BigtableInstanceAdmin.PartialUpdateCluster in GCP for Bigtable, it can result in compliance violations. Unauthorized changes to the cluster configuration can lead to non-compliance with industry regulations or internal security policies, potentially resulting in legal and financial consequences for the organization.

​
Remediation

​
Using Console

  1. Enable VPC Service Controls for GCP Bigtable:

    • Go to the GCP Console and navigate to the VPC Service Controls page.
    • Click on “Create Perimeter” and provide a name for the perimeter.
    • Select the project where your GCP Bigtable instance is located.
    • Choose the desired VPC network and subnet for the perimeter.
    • Add any additional authorized networks if required.
    • Review the configuration and click on “Create” to create the perimeter.
    • Once the perimeter is created, go to the GCP Bigtable instance page.
    • Click on “Edit” and scroll down to the “VPC Service Controls” section.
    • Enable VPC Service Controls and select the created perimeter.
    • Save the changes to apply the VPC Service Controls to your GCP Bigtable instance.

  2. Enable Audit Logging for GCP Bigtable:

    • Go to the GCP Console and navigate to the GCP Bigtable instance page.
    • Click on “Edit” and scroll down to the “Audit Logging” section.
    • Enable audit logging by selecting the desired audit logs to be recorded.
    • Choose the destination for the logs, such as Cloud Storage or BigQuery.
    • Configure the retention period for the logs.
    • Save the changes to enable audit logging for your GCP Bigtable instance.

  3. Enable Encryption at Rest for GCP Bigtable:

    • Go to the GCP Console and navigate to the GCP Bigtable instance page.
    • Click on “Edit” and scroll down to the “Encryption at Rest” section.
    • Enable encryption at rest by selecting the desired encryption key.
    • Choose the key management service (KMS) provider and key version.
    • Save the changes to enable encryption at rest for your GCP Bigtable instance.

​
Using CLI

To remediate the issues mentioned in the previous response for GCP Bigtable using GCP CLI, you can follow these steps:

  1. Enable audit logging for GCP Bigtable:

    • Use the following command to enable audit logging for Bigtable: 
      gcloud logging sinks create [SINK_NAME] bigtable.googleapis.com/projects/[PROJECT_ID]/instances/[INSTANCE_ID] --log-filter='resource.type="bigtable_instance"'
    • Replace [SINK_NAME] with a name for the sink, [PROJECT_ID] with your GCP project ID, and [INSTANCE_ID] with the ID of your Bigtable instance.

  2. Implement VPC Service Controls for Bigtable:

    • Create a VPC Service Controls perimeter for Bigtable using the following command: 
      gcloud access-context-manager perimeters create [PERIMETER_NAME] --resources=bigtable.googleapis.com/projects/[PROJECT_ID]/instances/[INSTANCE_ID] --restricted-services=bigtable.googleapis.com
    • Replace [PERIMETER_NAME] with a name for the perimeter.

  3. Enable encryption at rest for Bigtable:

    • Use the following command to enable encryption at rest for Bigtable: 
      gcloud beta bigtable instances update [INSTANCE_ID] --cluster=[CLUSTER_ID] --encryption-at-rest-state=ENABLED
    • Replace [INSTANCE_ID] with the ID of your Bigtable instance and [CLUSTER_ID] with the ID of your Bigtable cluster.

Please note that the above commands are examples and may need to be modified based on your specific GCP setup and requirements.

​
Using Python

To remediate the issues mentioned in the previous response for GCP Bigtable using Python, you can follow these steps:

  1. Enable VPC Service Controls:
    • Use the google-cloud-bigtable library in Python to create a new Bigtable instance.
    • Set the location_id parameter to specify the location of the instance.
    • Enable VPC Service Controls by setting the enable_vpc_service_controls parameter to True while creating the instance.
from google.cloud import bigtable

project_id = 'your-project-id'
instance_id = 'your-instance-id'
location_id = 'your-location-id'

client = bigtable.Client(project=project_id, admin=True)
instance = client.instance(instance_id, location_id=location_id, enable_vpc_service_controls=True)
instance.create()
  1. Implement IAM Roles and Permissions:
    • Use the google-cloud-iam library in Python to manage IAM roles and permissions for Bigtable.
    • Use the google.cloud.iam.Policy class to get the existing IAM policy for the Bigtable instance.
    • Add or remove the necessary roles and permissions using the add_binding() and remove_role() methods.
    • Set the updated IAM policy using the set_policy() method.
from google.cloud import iam

project_id = 'your-project-id'
instance_id = 'your-instance-id'

client = iam.IAMClient()
policy = client.get_policy(request={"resource": f"projects/{project_id}/instances/{instance_id}"})

# Add a new role to the policy
policy.add_binding(role="roles/bigtable.reader", members=["user:[email protected]"])

# Remove an existing role from the policy
policy.remove_role(role="roles/bigtable.admin")

# Set the updated policy
client.set_policy(request={"resource": f"projects/{project_id}/instances/{instance_id}", "policy": policy})
  1. Implement Audit Logging:
    • Use the google-cloud-logging library in Python to enable audit logging for Bigtable.
    • Create a new sink using the google.cloud.logging.Sink class and specify the destination for the logs.
    • Set the filter to include only the relevant Bigtable logs.
    • Create the sink using the create() method.
from google.cloud import logging

project_id = 'your-project-id'
sink_name = 'your-sink-name'
destination = 'your-destination'

client = logging.Client(project=project_id)
sink = client.sink(sink_name, filter_='logName:"projects/{project_id}/logs/cloudaudit.googleapis.com%2Fdata_access"')
sink.destination = destination
sink.create()

Please note that you need to replace the placeholders (your-project-id, your-instance-id, your-location-id, your-sink-name, your-destination) with the actual values specific to your GCP environment.