GCP Terraform Misconfiguration: Cloud Storage Bucket Uniform Access Disabled

Abstract

Terraform 組態設定了一個允許使用存取控制清單來控制權限的 Google Storage 儲存貯體。

Explanation

權限管理不善會增加未經授權存取或限制資料遭到修改的風險。

為了定義存取儲存貯體和儲存貯體中物件的使用者權限，Google Cloud Storage 提供了兩個系統：存取控制清單 (ACL) 和 Identity and Access Management (IAM)。IAM 可以在整個 Google Cloud 中使用，但只有 Cloud Storage 支援 ACL。啟用 Uniform Bucket-level Access 會阻止 ACL 授予權限。這可確保 IAM 是管理 Google Cloud 資源所有存取控制的唯一系統。

範例 1：以下 Terraform 組態透過將 uniform_bucket_level_access 設為 false，來允許使用 ACL 和 IAM 授予對儲存貯體的存取權限。


resource "google_storage_bucket" "bucket-demo" {
...
  uniform_bucket_level_access = false
...
}

References

[1] HashiCorp google_storage_bucket

[2] Google Cloud Uniform bucket-level access

[3] Google Cloud Organization policy constraints for Cloud Storage

[4] Standards Mapping - CIS Google Cloud Computing Platform Benchmark Recommendation 5.2

[5] Standards Mapping - Common Weakness Enumeration CWE ID 284

[6] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-002121

[7] Standards Mapping - FIPS200 AC

[8] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[9] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-2 Account Management (P1)

[10] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-2 Account Management

[11] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[12] Standards Mapping - OWASP Application Security Verification Standard 4.0 1.4.4 Access Control Architectural Requirements (L2 L3)

[13] Standards Mapping - OWASP Top 10 2017 A5 Broken Access Control

[14] Standards Mapping - OWASP Top 10 2021 A01 Broken Access Control

[15] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002880 CAT II

[16] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002880 CAT II

[17] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002880 CAT II

[18] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002880 CAT II

[19] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002880 CAT II

[20] Standards Mapping - Security Technical Implementation Guide Version 6.2 APSC-DV-002880 CAT II

desc.structural.hcl.gcp_terraform_misconfiguration_cloud_storage_bucket_uniform_access_disabled