​
Event Information

  • The google.pubsub.v1.Subscriber.CreateSubscription event in GCP for Pubsub indicates the creation of a new subscription within a Pubsub topic.
  • This event signifies that a subscriber has been created to receive messages published to the specified topic.
  • It is important to monitor this event as it allows you to track the creation of new subscriptions and ensure that the necessary permissions and configurations are in place for message delivery.

​
Examples

  • Unauthorized access: If proper access controls are not implemented, an attacker may be able to create a subscription without proper authorization. This can lead to unauthorized access to sensitive data or the ability to receive and process messages intended for other subscribers.

  • Data leakage: If the subscription is created with incorrect configuration settings, it may inadvertently expose sensitive data to unauthorized parties. For example, if the subscription is created with a publicly accessible endpoint, anyone with the subscription name can potentially receive and access the messages.

  • Denial of Service (DoS) attacks: If an attacker is able to create a large number of subscriptions, it can potentially overwhelm the system and cause a DoS attack. This can result in service disruption and impact the availability of the Pubsub service for legitimate users.

​
Remediation

​
Using Console

  1. Enable audit logging for GCP Pub/Sub:

    • Go to the GCP Console and navigate to the Pub/Sub section.
    • Select the specific Pub/Sub topic or subscription that you want to enable audit logging for.
    • Click on the “Edit” button to modify the settings.
    • Under the “Logging” section, enable the “Audit logs” option.
    • Choose the appropriate log sink destination, such as Cloud Storage or BigQuery.
    • Save the changes.

  2. Implement VPC Service Controls for GCP Pub/Sub:

    • Go to the GCP Console and navigate to the VPC Service Controls section.
    • Create a new service perimeter or select an existing one that includes the Pub/Sub resources.
    • Configure the access levels and permissions for the Pub/Sub resources within the service perimeter.
    • Apply the service perimeter to the appropriate projects or organizations.
    • Save the changes.

  3. Implement IAM roles and permissions for GCP Pub/Sub:

    • Go to the GCP Console and navigate to the IAM & Admin section.
    • Select the specific project that contains the Pub/Sub resources.
    • Click on the “IAM” tab to manage IAM roles and permissions.
    • Assign the appropriate IAM roles to the users or service accounts that need access to Pub/Sub.
    • Make sure to follow the principle of least privilege and only grant the necessary permissions.
    • Save the changes.

Note: These instructions assume that you have the necessary permissions and access to the GCP Console.

​
Using CLI

To remediate the issues mentioned in the previous response for GCP Pub/Sub using GCP CLI, you can follow these steps:

  1. Enable audit logging for Pub/Sub:

    • Use the following command to enable audit logging for Pub/Sub: 
      gcloud pubsub topics set-iam-policy <TOPIC_NAME> policy.json
    • Replace <TOPIC_NAME> with the name of the Pub/Sub topic you want to enable audit logging for.
    • Create a policy.json file with the following content: 
      {
  "auditConfigs": [
    {
      "auditLogConfigs": [
        {
          "logType": "DATA_READ",
          "exemptedMembers": []
        },
        {
          "logType": "DATA_WRITE",
          "exemptedMembers": []
        }
      ],
      "service": "pubsub.googleapis.com"
    }
  ],
  "bindings": [
    {
      "role": "roles/pubsub.publisher",
      "members": [
        "user:<USER_EMAIL>"
      ]
    }
  ]
}
    • Replace <USER_EMAIL> with the email address of the user who should have the pubsub.publisher role.

  2. Implement VPC Service Controls for Pub/Sub:

    • Use the following command to create a VPC Service Controls perimeter for Pub/Sub: 
      gcloud access-context-manager perimeters create <PERIMETER_NAME> --resources=pubsub.googleapis.com/projects/<PROJECT_ID>/topics/*
    • Replace <PERIMETER_NAME> with a name for the perimeter and <PROJECT_ID> with your GCP project ID.

  3. Enable Pub/Sub encryption at rest:

    • Use the following command to enable encryption at rest for Pub/Sub: 
      gcloud pubsub topics update <TOPIC_NAME> --message-storage-policy-encryption-key=projects/<PROJECT_ID>/locations/global/keyRings/<KEY_RING_NAME>/cryptoKeys/<CRYPTO_KEY_NAME>
    • Replace <TOPIC_NAME> with the name of the Pub/Sub topic you want to enable encryption for, <PROJECT_ID> with your GCP project ID, <KEY_RING_NAME> with the name of the key ring, and <CRYPTO_KEY_NAME> with the name of the crypto key.

Please note that the above commands are examples and may need to be modified based on your specific requirements and configurations.

​
Using Python

To remediate the issues mentioned in the previous response for GCP Pub/Sub using Python, you can follow these steps:

  1. Enable VPC Service Controls:

    • Use the google-cloud-securitycenter library to enable VPC Service Controls for your project.
    • Here’s an example Python script to enable VPC Service Controls:
    from google.cloud import securitycenter

client = securitycenter.SecurityCenterClient()

# Set the project ID and organization ID
project_id = 'your-project-id'
organization_id = 'your-organization-id'

# Enable VPC Service Controls
response = client.update_organization_settings(
    organization_settings={
        'name': f'organizations/{organization_id}/organizationSettings',
        'enable_vpc_service_controls': True
    }
)

print('VPC Service Controls enabled successfully.')

  2. Implement Pub/Sub access controls:

    • Use the google-cloud-pubsub library to implement access controls for your Pub/Sub topics and subscriptions.
    • Here’s an example Python script to create a new topic with access controls:
    from google.cloud import pubsub_v1

publisher = pubsub_v1.PublisherClient()

# Set the project ID and topic name
project_id = 'your-project-id'
topic_name = 'your-topic-name'

# Create a new topic with access controls
topic_path = publisher.topic_path(project_id, topic_name)
topic = publisher.create_topic(request={"name": topic_path, "labels": {"access_level": "private"}})

print(f'Topic {topic.name} created successfully with access controls.')

  3. Monitor and analyze Pub/Sub logs:

    • Use the google-cloud-logging library to monitor and analyze the logs generated by Pub/Sub.
    • Here’s an example Python script to retrieve and analyze Pub/Sub logs:
    from google.cloud import logging

client = logging.Client()

# Set the project ID and filter for Pub/Sub logs
project_id = 'your-project-id'
filter_str = 'logName:"projects/{project_id}/logs/cloudaudit.googleapis.com%2Fdata_access"'

# Retrieve and analyze Pub/Sub logs
logs = client.list_entries(filter_=filter_str)
for log in logs:
    print(f'Log entry: {log.payload}')

Please note that you need to install the required libraries (google-cloud-securitycenter, google-cloud-pubsub, google-cloud-logging) using pip before running these scripts.