GCP cloud storage bucket with uniform bucket-level access disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_29
Category - Subcategory	Storage - Permissions
Provider	GCP
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	761e3fae-4a27-41bb-a9ea-ab063b35d574

Impact

For a user to access a Cloud Storage resource only one of the systems needs to grant the user permission. Cloud IAM is used throughout Google Cloud and allows you to grant a variety of permissions at bucket and project levels. ACLs have limited permission options, are used only by Cloud Storage, and allow you to grant permissions on a per-object basis. Cloud Storage has uniform bucket-level access that supports a uniform permissions system. Using this feature disables ACLs for all Cloud Storage resources.

Access to Cloud Storage resources is granted exclusively through Cloud IAM. Enabling uniform bucket-level access guarantees that if a Storage bucket is not publicly accessible, no object in the bucket is publicly accessible.

We recommend you enable uniform bucket-level access on Cloud Storage buckets. Uniform bucket-level access is used to unify and simplify how you grant access to your Cloud Storage resources. Cloud Storage offers two systems that act in parallel for granting users permission to access your buckets and objects:

• Cloud Identity and Access Management (Cloud IAM)
• Access Control Lists (ACLs).

How to Fix

Resource: google_storage_bucket

• Arguments: uniform_bucket_level_access is set to true, [source,go]

---

resource "google_storage_bucket" "examplea" { name = "terragoat-${var.environment}" bucket_policy_only = true

• uniform_bucket_level_access = true }

---