Basic roles used at the folder level misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_116
Category - Subcategory	IAM - Overly Permissive
Provider	GCP
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

This rule is checking for the use of basic roles at the folder level within Google Cloud Platform (GCP). Basic roles include primitive roles (Owner, Editor, Viewer) and predefined roles that have a wide range of permissions. Using these basic roles at the folder level can be a security risk as it might grant more permissions than necessary to users or services, violating the principle of least privilege. Accessibility or modification of sensitive data beyond what's required can lead to data breaches or unwanted changes. Therefore, it's recommended to grant only specific, necessary permissions to users or services.

How to Fix

Resource: 'google_folder_iam_member', 'google_folder_iam_binding'

Apply the principle of least privilege. Always provide only the level of access necessary to the services your applications need, no more and no less.

This provides the user '[e-mail]' with the 'Monitoring editor' role. This is one step up from 'basic roles', and is expected to be secure enough as per the policy because it restricts the broad access provided by basic roles.

Avoid running basic roles at folder level, like 'roles/editor', 'roles/viewer' or 'roles/owner'. These roles are legacy and over-grant permissions. In contrast, predefined roles offer more granular access control to resources. [source,go]

resource "google_folder_iam_binding" "folder_iam_binding" { members = [ "user:[e-mail]", ]

role = "roles/monitoring.editor" }