Detections
Analytics

5.1.2 Minimize user access to GCR

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Restrict user access to GCR, limiting interaction with build images to only authorized personnel and service accounts.

Rationale:

Weak access control to GCR may allow malicious users to replace built images with vulnerable or backdoored containers.

Impact:

Care should be taken not to remove access to GCR for accounts that require this for their operation. Any account granted the Storage Object Viewer role at the project level can view all objects stored in GCS for the project.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Using Google Cloud Console:
To modify roles granted at the GCR bucket level

Go to Storage Browser by visiting https://console.cloud.google.com/storage/browser

From the list of storage buckets, select artifacts.[PROJECT_ID].appspot.com for the GCR bucket

Under the Permissions tab, modify permissions of the identified member via the drop down role menu and change the Role to Storage Object Viewer for read-only access.

For a User or Service account with Project level permissions inherited by the GCR bucket, or the Service Account User Role:

Go to IAM by visiting https://console.cloud.google.com/iam-admin/iam

Find the User or Service account to be modified and click on the corresponding pencil icon

Remove the create/modify role (Storage Admin / Storage Object Admin / Storage Object Creator / Service Account User) on the user or service account

If required add the Storage Object Viewer role - note with caution that this permits the account to view all objects stored in GCS for the project.

Using Command Line:
To change roles at the GCR bucket level:
Firstly, run the following if read permissions are required:

gsutil iam ch [TYPE]:[EMAIL-ADDRESS]:objectViewer gs://artifacts.[PROJECT_ID].appspot.com

Then remove the excessively privileged role (Storage Admin / Storage Object Admin / Storage Object Creator) using:

gsutil iam ch -d [TYPE]:[EMAIL-ADDRESS]:[ROLE] gs://artifacts.[PROJECT_ID].appspot.com

where:

[TYPE] can be one of the following:

user, if the [EMAIL-ADDRESS] is a Google account

serviceAccount, if [EMAIL-ADDRESS] specifies a Service account

[EMAIL-ADDRESS] can be one of the following:

a Google account (for example, [email protected])

a Cloud IAM service account

To modify roles defined at the project level and subsequently inherited within the GCR bucket, or the Service Account User role, extract the IAM policy file, modify it accordingly and apply it using:

gcloud projects set-iam-policy [PROJECT_ID] [POLICY_FILE]

Default Value:

By default, GCR is disabled and access controls are set during initialization.

See Also

https://workbench.cisecurity.org/files/4135

Item Details

References: CSCv7|14.6

Plugin: GCP

Control ID: abb9c57596ccbd62331b47f4ad521182ac4314442f4249b770e4680b5a134086