GCP Terraform Misconfiguration: Cloud Storage Bucket Uniform Access Disabled

Abstract

Terraform 配置设置了一个 Google Storage 存储桶，允许使用访问控制列表来控制权限。

Explanation

权限管理不善会增加未经授权访问或修改受限数据的风险。

为了定义访问存储桶和存储桶中对象的用户权限，Google Cloud Storage 提供了两个系统：访问控制列表 (ACL) 与身份和访问管理 (IAM)。IAM 可在整个 Google Cloud 中使用，而 ACL 仅可用于 Cloud Storage。启用统一存储桶级访问权限会阻止 ACL 授予权限。这可确保 IAM 是管理 Google Cloud 资源的所有访问控制的唯一系统。

示例 1：以下 Terraform 配置通过将 uniform_bucket_level_access 设置为 false，允许使用 ACL 和 IAM 来授予对存储桶的访问权限。


resource "google_storage_bucket" "bucket-demo" {
...
  uniform_bucket_level_access = false
...
}

References

[1] HashiCorp google_storage_bucket

[2] Google Cloud Uniform bucket-level access

[3] Google Cloud Organization policy constraints for Cloud Storage

[4] Standards Mapping - CIS Google Cloud Computing Platform Benchmark Recommendation 5.2

[5] Standards Mapping - Common Weakness Enumeration CWE ID 284

[6] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-002121

[7] Standards Mapping - FIPS200 AC

[8] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[9] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-2 Account Management (P1)

[10] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-2 Account Management

[11] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[12] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.4.4 Access Control Architectural Requirements (L2 L3)

[13] Standards Mapping - OWASP Top 10 2017 A5 Broken Access Control

[14] Standards Mapping - OWASP Top 10 2021 A01 Broken Access Control

[15] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002880 CAT II

[16] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002880 CAT II

[17] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002880 CAT II

[18] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002880 CAT II

[19] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002880 CAT II

desc.structural.hcl.gcp_terraform_misconfiguration_cloud_storage_bucket_uniform_access_disabled