Google.bigtable.admin.v2.bigtabletableadmin.deletebackup

​

Event Information

• The google.bigtable.admin.v2.BigtableTableAdmin.DeleteBackup event in GCP for Bigtable indicates that a backup of a Bigtable table has been deleted.
• This event is triggered when a user or an automated process initiates the deletion of a backup.
• The event provides information about the backup that was deleted, such as the backup ID and the name of the table from which the backup was taken.

​

Examples

1. Unauthorized deletion: If proper access controls and permissions are not in place, an attacker could potentially delete backups using the google.bigtable.admin.v2.BigtableTableAdmin.DeleteBackup method. This could result in permanent data loss and compromise the integrity of the system.
2. Data leakage: If an unauthorized user gains access to the google.bigtable.admin.v2.BigtableTableAdmin.DeleteBackup method, they could potentially delete backups containing sensitive data. This could lead to data leakage and violation of compliance regulations, such as GDPR or HIPAA.
3. Denial of service: If an attacker gains access to the google.bigtable.admin.v2.BigtableTableAdmin.DeleteBackup method, they could potentially delete backups as a form of sabotage. This could result in a denial of service, impacting the availability and reliability of the Bigtable service.

​

Remediation

​

Using Console

1. Enable VPC Service Controls:
   • Go to the GCP Console and navigate to the VPC Service Controls page.
   • Click on “Create Perimeter” and provide a name for the perimeter.
   • Select the project where your Bigtable instance is located.
   • Choose the desired VPC network and subnet for the perimeter.
   • Click on “Create” to create the perimeter.
   • Once the perimeter is created, click on “Add Access Level” to define the access level for Bigtable.
   • Select the Bigtable API and choose the desired access level.
   • Click on “Add Access Level” to save the access level.
   • Finally, click on “Attach” to attach the perimeter to the project.
2. Enable Audit Logging:
   • Go to the GCP Console and navigate to the Bigtable instance page.
   • Click on the instance name to open the instance details.
   • In the left navigation menu, click on “Audit Logs”.
   • Click on “Enable Audit Logs” and choose the desired log sink.
   • Select the log sink destination and click on “Enable” to enable audit logging for the Bigtable instance.
3. Implement IAM Roles and Permissions:
   • Go to the GCP Console and navigate to the IAM & Admin page.
   • Click on “IAM” to open the IAM page.
   • Click on “Add” to add a new member.
   • Enter the email address of the user or service account that needs access to Bigtable.
   • Select the desired role for the user or service account (e.g., Bigtable Admin, Bigtable User).
   • Click on “Save” to save the changes.
   • Repeat the above steps for each user or service account that needs access to Bigtable.

​

Using CLI

1. Enable audit logging for GCP Bigtable:
   • Use the following command to enable audit logging for Bigtable:
     Copy

     Ask AI

     gcloud logging sinks create [SINK_NAME] bigtable.googleapis.com/projects/[PROJECT_ID]/instances/[INSTANCE_ID] --log-filter='resource.type="bigtable_instance"'
     

   • Replace [SINK_NAME] with a name for the sink, [PROJECT_ID] with your GCP project ID, and [INSTANCE_ID] with the ID of your Bigtable instance.
2. Implement VPC Service Controls for Bigtable:
   • Create a VPC Service Controls perimeter for Bigtable using the following command:
     Copy

     Ask AI

     gcloud access-context-manager perimeters create [PERIMETER_NAME] --resources=bigtable.googleapis.com/projects/[PROJECT_ID]/instances/[INSTANCE_ID] --restricted-services=bigtable.googleapis.com
     

   • Replace [PERIMETER_NAME] with a name for the perimeter.
3. Enable encryption at rest for Bigtable:
   • Use the following command to enable encryption at rest for Bigtable:
     Copy

     Ask AI

     gcloud beta bigtable instances update [INSTANCE_ID] --cluster=[CLUSTER_ID] --encryption-at-rest-state=ENABLED
     

   • Replace [INSTANCE_ID] with the ID of your Bigtable instance and [CLUSTER_ID] with the ID of your Bigtable cluster.

​

Using Python

1. Enable VPC Service Controls:
   • Use the google-cloud-bigtable library in Python to create a new Bigtable instance.
   • Set the location_id parameter to specify the location of the instance.
   • Enable VPC Service Controls by setting the enable_vpc_service_controls parameter to True while creating the instance.

from google.cloud import bigtable

project_id = 'your-project-id'
instance_id = 'your-instance-id'
location_id = 'your-location-id'

client = bigtable.Client(project=project_id, admin=True)
instance = client.instance(instance_id, location_id=location_id, enable_vpc_service_controls=True)
instance.create()

2. Implement IAM Roles and Permissions:
   • Use the google-cloud-iam library in Python to manage IAM policies for Bigtable.
   • Use the Policy class to create a new policy object.
   • Add the necessary bindings to the policy object to grant appropriate roles and permissions to users or service accounts.

from google.cloud import iam

project_id = 'your-project-id'
instance_id = 'your-instance-id'

client = iam.IAMClient()
policy = client.get_policy(request={"resource": f"projects/{project_id}/instances/{instance_id}"})

# Add bindings to the policy object
policy.bindings.add(role="roles/bigtable.reader", members=["user:[email protected]"])
policy.bindings.add(role="roles/bigtable.admin", members=["serviceAccount:[email protected]"])

# Update the policy
client.set_policy(request={"resource": f"projects/{project_id}/instances/{instance_id}", "policy": policy})

3. Implement Audit Logging:
   • Use the google-cloud-logging library in Python to enable audit logging for Bigtable.
   • Create a new logger and set the appropriate log level and filters.
   • Use the logger to log relevant events and actions within your Bigtable application.

import logging

project_id = 'your-project-id'
log_name = 'your-log-name'

logger = logging.getLogger(log_name)
logger.setLevel(logging.INFO)

# Log an event
logger.info('An action was performed in Bigtable.')

# Log an error
logger.error('An error occurred in Bigtable.')