Google.storage.v1.storage.deletebucketaccesscontrol

​

Event Information

• The google.storage.v1.Storage.DeleteBucketAccessControl event in GCP for CloudStorage indicates that a bucket access control configuration has been deleted.
• This event signifies a change in the permissions or access control settings for a specific bucket in Google Cloud Storage.
• It is important to monitor this event as it can help track any modifications or deletions made to the access control list (ACL) of a bucket, ensuring the security and compliance of the data stored in the bucket.

​

Examples

1. Unauthorized access: If security is impacted with google.storage.v1.Storage.DeleteBucketAccessControl in GCP for CloudStorage, it could potentially allow unauthorized users to delete bucket access controls. This could lead to unauthorized access to sensitive data stored in the bucket, compromising the confidentiality and integrity of the data.
2. Data loss: If the bucket access controls are deleted using google.storage.v1.Storage.DeleteBucketAccessControl, it could result in accidental or intentional deletion of critical access controls. This can lead to data loss or unauthorized modification of data within the bucket, impacting the availability and integrity of the data.
3. Compliance violations: Deleting bucket access controls without proper authorization or auditing can result in compliance violations. Organizations may have specific access control requirements mandated by industry regulations or internal policies. If these controls are deleted, it can lead to non-compliance and potential legal and financial consequences.

​

Remediation

​

Using Console

1. Enable versioning for Cloud Storage buckets:
   • Go to the GCP Console and navigate to the Cloud Storage section.
   • Select the bucket for which you want to enable versioning.
   • Click on the “Edit bucket permissions” button.
   • In the “Bucket permissions” tab, click on the “Add members” button.
   • Add the appropriate IAM member with the necessary permissions.
   • Click on the “Add” button to save the changes.
2. Implement access controls for Cloud Storage buckets:
   • Go to the GCP Console and navigate to the Cloud Storage section.
   • Select the bucket for which you want to implement access controls.
   • Click on the “Edit bucket permissions” button.
   • In the “Bucket permissions” tab, click on the “Add members” button.
   • Add the appropriate IAM member with the necessary permissions.
   • Click on the “Add” button to save the changes.
3. Enable audit logging for Cloud Storage buckets:
   • Go to the GCP Console and navigate to the Cloud Storage section.
   • Select the bucket for which you want to enable audit logging.
   • Click on the “Edit bucket permissions” button.
   • In the “Bucket permissions” tab, click on the “Add members” button.
   • Add the appropriate IAM member with the necessary permissions.
   • Click on the “Add” button to save the changes.

​

Using CLI

1. Enable versioning for the affected bucket:
   • Use the following command to enable versioning for a specific bucket:
     gsutil versioning set on gs://[BUCKET_NAME]
     
2. Set appropriate access controls for the bucket:
   • Use the following command to set the bucket’s access control to private:
     gsutil iam ch allUsers:objectViewer gs://[BUCKET_NAME]
     
3. Enable object lifecycle management to automatically delete outdated objects:
   • Use the following command to set a lifecycle rule for the bucket:
     gsutil lifecycle set [LIFECYCLE_CONFIG_FILE] gs://[BUCKET_NAME]
     
     Replace [LIFECYCLE_CONFIG_FILE] with the path to a JSON file containing the lifecycle configuration.

​

Using Python

1. Enable versioning for Cloud Storage buckets:
   • Use the google-cloud-storage library to interact with Cloud Storage in Python.
   • Use the get_bucket() method to retrieve the bucket object.
   • Use the versioning_enabled property to check if versioning is already enabled.
   • If versioning is not enabled, use the enable_versioning() method to enable it.

from google.cloud import storage

def enable_versioning(bucket_name):
    storage_client = storage.Client()
    bucket = storage_client.get_bucket(bucket_name)
    
    if not bucket.versioning_enabled:
        bucket.enable_versioning()
        print(f"Versioning enabled for bucket: {bucket_name}")
    else:
        print(f"Versioning already enabled for bucket: {bucket_name}")

# Usage
enable_versioning("my-bucket")

2. Set appropriate access controls for Cloud Storage buckets:
   • Use the google-cloud-storage library to interact with Cloud Storage in Python.
   • Use the get_bucket() method to retrieve the bucket object.
   • Use the iam property to access the IAM policies of the bucket.
   • Use the bindings property to modify the access control bindings.
   • Use the add_member() method to add a new member with the desired role.

from google.cloud import storage

def set_bucket_acl(bucket_name, member, role):
    storage_client = storage.Client()
    bucket = storage_client.get_bucket(bucket_name)
    
    policy = bucket.iam.policy
    policy.bindings.append({"role": role, "members": [member]})
    
    bucket.iam.policy = policy
    bucket.iam.save()
    
    print(f"Added member '{member}' with role '{role}' to bucket: {bucket_name}")

# Usage
set_bucket_acl("my-bucket", "user:example@example.com", "roles/storage.objectViewer")

3. Enable Cloud Storage bucket logging:
   • Use the google-cloud-storage library to interact with Cloud Storage in Python.
   • Use the get_bucket() method to retrieve the bucket object.
   • Use the logging property to access the logging configuration of the bucket.
   • Use the set_log_bucket() method to set the target bucket for logging.

from google.cloud import storage

def enable_bucket_logging(bucket_name, log_bucket_name):
    storage_client = storage.Client()
    bucket = storage_client.get_bucket(bucket_name)
    
    bucket.logging.log_bucket = log_bucket_name
    bucket.logging.save()
    
    print(f"Enabled logging for bucket: {bucket_name}. Logs will be stored in bucket: {log_bucket_name}")

# Usage
enable_bucket_logging("my-bucket", "my-log-bucket")