Enforce Uniform Bucket-Level Access at Organization Level

Trend Micro Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 750 automated best practice checks.

Risk level: Medium (should be achieved)

Ensure that "Enforce uniform bucket-level access" policy is enabled for your Google Cloud Platform (GCP) organization in order to enforce uniform bucket-level access for all Google Cloud Storage buckets available in your organization.

Security

Enforcing uniform bucket-level access disables Access Control Lists (ACLs) for all Cloud Storage resources (buckets and objects) so that the access is granted exclusively through Cloud IAM service which is more efficient and secure. This type of access is also used to unify and simplify how you grant access to your Cloud Storage resources. The "Enforce uniform bucket-level access" organization policy requires storage buckets to use uniform bucket-level access where the constraint is set to True. Once this policy is implemented, any new bucket created inside your GCP organization should have uniform bucket-level access enabled, and no existing buckets within the organization can disable uniform bucket-level access.


Audit

To determine if "Enforce uniform bucket-level access" policy is enabled for your GCP organizations, perform the following actions:

Using GCP Console

01 Sign in to Google Cloud Management Console with the organizational unit credentials.

02 Click on the deployment selector from the top navigation bar, select ALL to list all the existing deployments, then choose the Google Cloud organization that you want to examine.

03 Navigate to Cloud Identity and Access Management (IAM) dashboard at https://console.cloud.google.com/iam-admin/iam.

04 In the navigation panel, select Organization Policies to access the list with the cloud organization policies available for your GCP organization.

05 Click inside the Filter by policy name or ID filter box, select Enforce uniform bucket-level access to return only the “Enforce uniform bucket-level access” organization policy.

06 Click on the name of the GCP organization policy returned at the previous step.

07 On the Policy details page, under Effective policy, check the Enforcement configuration attribute status. If the Enforcement attribute status is set to Not enforced, the policy is not enabled within your organization, therefore the enforcement of enabling uniform bucket-level access for all new Google Cloud Storage buckets is disabled for the selected GCP organization.

08 Repeat steps no. 2 – 7 for each organization available in in your Google Cloud account.

Using GCP CLI

01 Run organizations list command (Windows/macOS/Linux) using custom query filters to list the ID of each GCP organization created within your Google Cloud account:

gcloud organizations list
  --format="table(name)"

02 The command output should return the requested organization identifiers (IDs):

ID
112233441122
123412341234

03 Run resource-manager org-policies describe command (Windows/macOS/Linux) using the ID of the GCP organization that you want to reconfigure as identifier parameter, to describe the enforcement configuration of the “Enforce uniform bucket-level access” policy (i.e. "storage.uniformBucketLevelAccess"), available for the selected organization:

gcloud alpha resource-manager org-policies describe
"storage.uniformBucketLevelAccess"
  --effective
  --organization=112233441122
  --format="table(booleanPolicy)"

04 The command request should return the requested configuration information:

BOOLEAN_POLICY
{}

If the resource-manager org-policies describe command output returns an empty object for the BOOLEAN_POLICY configuration attribute, i.e. {}, the “Enforce uniform bucket-level access” policy is not enforced at the organization level, therefore the enforcement of enabling uniform bucket-level access for all new Google Cloud Storage buckets is disabled for the selected GCP organization.

05 Repeat step no. 3 and 4 for each organization created within in your Google Cloud account.

Remediation / Resolution

To ensure that uniform bucket-level access is enabled for all new Google Cloud Storage buckets created within your GCP organization, enable the “Enforce uniform bucket-level access” organization policy by performing the following operations:

Using GCP Console

01 Sign in to Google Cloud Management Console with the organizational unit credentials.

02 Click on the deployment selector from the top navigation bar, select ALL to list all the existing deployments, then choose the Google Cloud organization that you want to reconfigure.

03 Navigate to Cloud Identity and Access Management (IAM) dashboard at https://console.cloud.google.com/iam-admin/iam.

04 In the navigation panel, select Organization Policies to access the list with the cloud organization policies available for your GCP organization.

05 Click inside the Filter by policy name or ID box, select Name and Enforce uniform bucket-level access to list only the “Enforce uniform bucket-level access” policy.

06 Click on the name of the GCP organization policy listed at the previous step.

07 On the Policy details page, click on the EDIT button from the dashboard top menu to edit the selected policy.

08 On the Edit policy configuration page, perform the following actions:

  1. Under Applies to, select Customize to choose the type of the policy to apply (i.e. customized policy).
  2. Under Enforcement, select On to enforce the "storage.uniformBucketLevelAccess" constraint. This policy constraint automatically enables uniform bucket-level access for all new Google Cloud Storage buckets created in the selected GCP organization.
  3. Click SAVE to apply the changes and enforce the “Enforce uniform bucket-level access” policy constraints.

09 If required, repeat steps no. 2 – 8 to enable the policy for other organizations available in your Google Cloud account.

Using GCP CLI

01 Run resource-manager org-policies enable-enforce command (Windows/macOS/Linux) using the ID of the Google Cloud Platform (GCP) organization that you want to reconfigure as identifier parameter, to enforce the “Enforce uniform bucket-level access” policy (i.e. "storage.uniformBucketLevelAccess") for the selected GCP organization:

gcloud alpha resource-manager org-policies enable-enforce
  "storage.uniformBucketLevelAccess"
  --organization=112233441122

02 The command request should return the reconfigured organization policy metadata:

booleanPolicy:
  enforced: true
constraint: constraints/storage.uniformBucketLevelAccess
etag: aabbccddabcd
updateTime: '2020-07-15T20:00:00.000Z'

03 If required, repeat step no. 1 and 2 to enforce the policy for other GCP organizations created within your Google Cloud account.

References

Publication date May 4, 2021

Unlock the Remediation Steps


Gain free unlimited access
to our full Knowledge Base


Over 750 rules & best practices
for AWS and Azure

You are auditing:

Enforce Uniform Bucket-Level Access at Organization Level

Risk level: Medium