Ensure compatibility firestore storage resource does not have access policy set to 'Public' for Google App Engine Application

MEDIUM

Description

Allowing unrestricted, public access to cloud services could open an application up to external attack. Disallowing this access is typically considered best practice.

Remediation

In GCP Console -

  1. Open the App Engine page.
  2. Select Firewall rules.
  3. Choose a rule to edit, Click on edit.
  4. Remove any rule with Action Allow and IP range *.
  5. Click Save.

In Terraform -

  1. In the resource google_app_engine_standard_app_version ensure that 'action' is set to ALLOW and if source_range is set to *.

References:
https://cloud.google.com/appengine/docs/standard/creating-firewalls
https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/app_engine_firewall_rule#action

Policy Details

Rule Reference ID: AC_GCP_0286
CSP: GCP
Remediation Available: No
Resource Category: Serverless
Resource Type: App Engine

Frameworks