GCP Terraform Misconfiguration: Cloud Storage Bucket Uniform Access Disabled

A Terraform configuration sets up a Google Storage Bucket that allows the use of Access Control Lists for controlling permissions.

Mismanagement of permissions increases the risk of unauthorized access to or modification of restricted data.

To define user permission for access to buckets and objects in buckets, Google Cloud Storage offers two systems: Access Control Lists (ACLs) and Identity and Access Management (IAM). IAM can be used throughout Google Cloud, while only Cloud Storage supports ACLs. Enabling Uniform Bucket-level Access prevents ACLs from granting permission. This ensures IAM is the only system to manage all access control of Google Cloud resources.

Example 1: The following Terraform configuration permits using ACLs alongside IAM to grant access to the storage bucket by setting uniform_bucket_level_access to false.

resource "google_storage_bucket" "bucket-demo" {
...
  uniform_bucket_level_access = false
...
}