Homepage

Cloud Storage Buckets allow AllUsers and AllAuthenticatedUsers Affecting Cloud Storage service in Google

Severity

0.0
high
0
10
Severity Framework
Snyk CCSS
Rule category
Data/ Access Control

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
  • Snyk IDSNYK-CC-00787
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

Granting permissions to AllUsers or AllAuthenticatedUsers can expose Cloud Storage buckets and their contents to the public, leading to unauthorized data access and potential data breaches. Ensuring that neither of these groups are granted permissions mitigates the risk of public exposure of sensitive data.

How to fix?

Set the members attribute in google_storage_bucket_iam resource to value other than allUsers or allAuthenticatedUsers.

Example configuration:

resource "google_storage_bucket" "snyk-787-bucket" {
  name          = "snyk-787"
  location      = "US"
  force_destroy = true
}

resource "google_storage_bucket_iam_binding" "allowed-binding-1" {
  bucket = google_storage_bucket.snyk-787-bucket.name
  role   = "roles/storage.admin"
  members = [
    "user:chakri@zelarsoft.com",
  ]
}

resource "google_storage_bucket_iam_member" "allowed-member-1" {
  bucket = google_storage_bucket.snyk-787-bucket-2.name
  role   = "roles/storage.admin"
  member = "serviceAccount:snyk-sa@zelarsoft-snyk.iam.gserviceaccount.com"
}

data "google_iam_policy" "admin-1" {
  binding {
    role = "roles/storage.admin"
    members = [
      "user:chakri@zelarsoft.com",
    ]
  }
}

resource "google_storage_bucket_iam_policy" "allowed-policy-1" {
  bucket      = google_storage_bucket.snyk-787-bucket-4.name
  policy_data = data.google_iam_policy.admin-1.policy_data
}