gcp/no-public-buckets
No Cloud Storage bucket is open to everyone on the internet.
Install
firedrill hub add gcp/no-public-buckets
Reads
gcp.projects, gcp.buckets
Fix when it fails
Remove allUsers and allAuthenticatedUsers from the bucket's IAM policy, then set public access prevention to enforced on the bucket, or on the organization.
Maps to
SOC2:CC6.1, ISO27001:A.8.3
Test cases
| Case | Expected |
|---|---|
| private and enforced | PASS |
| allUsers can read | FAIL |
| private but prevention not enforced | WARN |
| no buckets | N/A |
Drill file
firedrill: v0
id: gcp/no-public-buckets
safeguard: "No Cloud Storage bucket is open to everyone on the internet."
severity: critical
for_each: gcp.projects
fetch:
buckets: { fact: gcp.buckets }
applies_when: buckets.size() > 0
na_reason: "the project has no buckets"
pass_when:
- buckets.filter(b, b.public_grants.size() > 0).size() == 0
warn_when:
- buckets.filter(b, b.public_access_prevention != "enforced").size() > 0
fix: "Remove allUsers and allAuthenticatedUsers from the bucket's IAM policy, then set public access prevention to enforced on the bucket, or on the organization."
maps_to: [SOC2:CC6.1, ISO27001:A.8.3]