Control: 5.2 Ensure That Cloud Storage Buckets Have Uniform Bucket-Level Access Enabled

Description

It is recommended that uniform bucket-level access is enabled on Cloud Storage buckets.

It is recommended to use uniform bucket-level access to unify and simplify how you grant access to your Cloud Storage resources.

Cloud Storage offers two systems for granting users permission to access your buckets and objects: Cloud Identity and Access Management (Cloud IAM) and Access Control Lists (ACLs). These systems act in parallel - in order for a user to access a Cloud Storage resource, only one of the systems needs to grant the user permission. Cloud IAM is used throughout Google Cloud and allows you to grant a variety of permissions at the bucket and project levels. ACLs are used only by Cloud Storage and have limited permission options, but they allow you to grant permissions on a per-object basis.

In order to support a uniform permissioning system, Cloud Storage has uniform bucket-level access. Using this feature disables ACLs for all Cloud Storage resources: access to Cloud Storage resources then is granted exclusively through Cloud IAM. Enabling uniform bucket-level access guarantees that if a Storage bucket is not publicly accessible, no object in the bucket is publicly accessible either.

Remediation

From Google Cloud Console

Open the Cloud Storage browser in the Google Cloud Console by visiting: https://console.cloud.google.com/storage/browser.
In the list of buckets, click on the name of the desired bucket.
Select the Permissions tab near the top of the page.
In the text box that starts with This bucket uses fine-grained access control..., click Edit.
In the pop-up menu that appears, select Uniform.
Click Save.

From Google Cloud CLI

Use the on option in a uniformbucketlevelaccess set command:

gsutil uniformbucketlevelaccess set on gs://BUCKET_NAME/

Prevention

You can set up an Organization Policy to enforce that any new bucket has uniform bucket level access enabled. Learn more at: https://cloud.google.com/storage/docs/setting-org-policies#uniform-bucket

Default Value

By default, Cloud Storage buckets do not have uniform bucket-level access enabled.

Usage

Run the control in your terminal:

powerpipe control run gcp_compliance.control.cis_v400_5_2

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run gcp_compliance.control.cis_v400_5_2 --share

SQL

This control uses a named query:

select
  self_link resource,
  case
    when iam_configuration_uniform_bucket_level_access_enabled then 'ok'
    else 'alarm'
  end as status,
  case
    when iam_configuration_uniform_bucket_level_access_enabled
      then title || ' uniform bucket-level access enabled.'
    else title || ' uniform bucket-level access not enabled.'
  end as reason
  
  , location as location, project as project
from
  gcp_storage_bucket;