Homepage
About Snyk

Cloud Storage Buckets allow AllUsers and AllAuthenticatedUsers Affecting Cloud Storage service in Google

0.0
high
    Severity Framework Snyk CCSS
    Rule category Data / Access Control

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
  • Snyk ID SNYK-CC-00787
  • credit Snyk Research Team
Report a new misconfiguration Found a mistake?

Description

Granting permissions to AllUsers or AllAuthenticatedUsers can expose Cloud Storage buckets and their contents to the public, leading to unauthorized data access and potential data breaches. Ensuring that neither of these groups are granted permissions mitigates the risk of public exposure of sensitive data.

How to fix?

Set the members attribute in google_storage_bucket_iam resource to value other than allUsers or allAuthenticatedUsers.

Example Configuration

resource "google_storage_bucket" "snyk-787-bucket" {
  name          = "snyk-787"
  location      = "US"
  force_destroy = true
}

resource "google_storage_bucket_iam_binding" "allowed-binding-1" {
  bucket = google_storage_bucket.snyk-787-bucket.name
  role   = "roles/storage.admin"
  members = [
    "user:chakri@zelarsoft.com",
  ]
}

resource "google_storage_bucket_iam_member" "allowed-member-1" {
  bucket = google_storage_bucket.snyk-787-bucket-2.name
  role   = "roles/storage.admin"
  member = "serviceAccount:snyk-sa@zelarsoft-snyk.iam.gserviceaccount.com"
}

data "google_iam_policy" "admin-1" {
  binding {
    role = "roles/storage.admin"
    members = [
      "user:chakri@zelarsoft.com",
    ]
  }
}

resource "google_storage_bucket_iam_policy" "allowed-policy-1" {
  bucket      = google_storage_bucket.snyk-787-bucket-4.name
  policy_data = data.google_iam_policy.admin-1.policy_data
}