Detections
Analytics
5.1.2 Minimize user access to GCR
Information
Restrict user access to GCR, limiting interaction with build images to only authorized personnel and service accounts.Rationale:
Weak access control to GCR may allow malicious users to replace built images with vulnerable or backdoored containers.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Using Google Cloud ConsoleTo modify roles granted at the GCR bucket level
Go to Storage Browser by visiting https://console.cloud.google.com/storage/browser
From the list of storage buckets, select artifacts.[PROJECT_ID].appspot.com for the GCR bucket
Under the Permissions tab, modify permissions of the identified member via the drop down role menu and change the Role to Storage Object Viewer for read-only access.
For a User or Service account with Project level permissions inherited by the GCR bucket, or the Service Account User Role:
Go to IAM by visiting https://console.cloud.google.com/iam-admin/iam
Find the User or Service account to be modified and click on the corresponding pencil icon
Remove the create/modify role (Storage Admin / Storage Object Admin / Storage Object Creator / Service Account User) on the user or service account
If required add the Storage Object Viewer role - note with caution that this permits the account to view all objects stored in GCS for the project.
Using Command Line
To change roles at the GCR bucket level:
Firstly, run the following if read permissions are required:
gsutil iam ch [TYPE]:[EMAIL-ADDRESS]:objectViewer gs://artifacts.[PROJECT_ID].appspot.com
Then remove the excessively privileged role (Storage Admin / Storage Object Admin / Storage Object Creator) using:
gsutil iam ch -d [TYPE]:[EMAIL-ADDRESS]:[ROLE] gs://artifacts.[PROJECT_ID].appspot.com
where:
[TYPE] can be one of the following:
user, if the [EMAIL-ADDRESS] is a Google account
serviceAccount, if [EMAIL-ADDRESS] specifies a Service account
[EMAIL-ADDRESS] can be one of the following:
a Google account (for example, [email protected])
a Cloud IAM service account
To modify roles defined at the project level and subsequently inherited within the GCR bucket, or the Service Account User role, extract the IAM policy file, modify it accordingly and apply it using:
gcloud projects set-iam-policy [PROJECT_ID] [POLICY_FILE]
Impact:
Care should be taken not to remove access to GCR for accounts that require this for their operation. Any account granted the Storage Object Viewer role at the project level can view all objects stored in GCS for the project.
Default Value:
By default, GCR is disabled and access controls are set during initialisation.
See Also
Item Details
References: CSCv7|14.6
Plugin: GCP
Control ID: b9737d2ec24297af44b67f3fa68bcf8e4b3f41329de60bd5996e852e83ec9e0e