Control: 5.1 Ensure that Cloud Storage bucket is not anonymously or publicly accessible
Description
It is recommended that IAM policy on Cloud Storage bucket does not allows anonymous or public access. Storage buckets are not publicly shared by default.
Allowing anonymous or public access grants permissions to anyone to access bucket content. Such access might not be desired if you are storing any sensitive data. Hence, ensure that anonymous or public access to a bucket is not allowed.
Remediation
From Console
- Login to GCP console and navigate to Storage Browser.
- Click on the bucket name to go to PERMISSIONS tab.
- Click REMOVE PUBLIC PERMISSIONS. Bucket will be
Not public.
From Command Line
Remove allUsers and allAuthenticatedUsers access.
gsutil iam ch -d allUsers gs://BUCKET_NAMEgsutil iam ch -d allAuthenticatedUsers gs://BUCKET_NAME
Usage
Run the control in your terminal:
powerpipe control run gcp_compliance.control.cis_v120_5_1Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run gcp_compliance.control.cis_v120_5_1 --shareSQL
This control uses a named query:
storage_bucket_not_publicly_accessible