github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/cloud/policies/google/storage/enable_ubla.go (about)

     1  package storage
     2  
     3  import (
     4  	"github.com/khulnasoft-lab/defsec/internal/rules"
     5  	"github.com/khulnasoft-lab/defsec/pkg/providers"
     6  	"github.com/khulnasoft-lab/defsec/pkg/scan"
     7  	"github.com/khulnasoft-lab/defsec/pkg/severity"
     8  	"github.com/khulnasoft-lab/defsec/pkg/state"
     9  )
    10  
    11  var CheckEnableUbla = rules.Register(
    12  	scan.Rule{
    13  		AVDID:       "AVD-GCP-0002",
    14  		Provider:    providers.GoogleProvider,
    15  		Service:     "storage",
    16  		ShortCode:   "enable-ubla",
    17  		Summary:     "Ensure that Cloud Storage buckets have uniform bucket-level access enabled",
    18  		Impact:      "ACLs are difficult to manage and often lead to incorrect/unintended configurations.",
    19  		Resolution:  "Enable uniform bucket level access to provide a uniform permissioning system.",
    20  		Explanation: `When you enable uniform bucket-level access on a bucket, Access Control Lists (ACLs) are disabled, and only bucket-level Identity and Access Management (IAM) permissions grant access to that bucket and the objects it contains. You revoke all access granted by object ACLs and the ability to administrate permissions using bucket ACLs.`,
    21  		Links: []string{
    22  			"https://cloud.google.com/storage/docs/uniform-bucket-level-access",
    23  			"https://jbrojbrojbro.medium.com/you-make-the-rules-with-authentication-controls-for-cloud-storage-53c32543747b",
    24  		},
    25  		Terraform: &scan.EngineMetadata{
    26  			GoodExamples:        terraformEnableUblaGoodExamples,
    27  			BadExamples:         terraformEnableUblaBadExamples,
    28  			Links:               terraformEnableUblaLinks,
    29  			RemediationMarkdown: terraformEnableUblaRemediationMarkdown,
    30  		},
    31  		Severity: severity.Medium,
    32  	},
    33  	func(s *state.State) (results scan.Results) {
    34  		for _, bucket := range s.Google.Storage.Buckets {
    35  			if bucket.Metadata.IsUnmanaged() {
    36  				continue
    37  			}
    38  			if bucket.EnableUniformBucketLevelAccess.IsFalse() {
    39  				results.Add(
    40  					"Bucket has uniform bucket level access disabled.",
    41  					bucket.EnableUniformBucketLevelAccess,
    42  				)
    43  			} else {
    44  				results.AddPassed(&bucket)
    45  			}
    46  		}
    47  		return
    48  	},
    49  )