Remove GCP Bucket AllAuthenticatedUser Access

This CLI command requires 'storage.buckets.getIamPolicy' and 'storage.buckets.setIamPolicy' permissions. Successful execution will revoke 'allAuthenticatedUsers' permission access in GCP Storage buckets.

Cloud Security Posture Management Playbooks

Details

ID25889dcf67314fd2c2bcde95af393dc1
Suggestion ReasonRecommended for preventing unauthorized access to GCP Bucket

Source

Trigger_-_Remove_GCP_Bucket_AllAuthenticatedUser_Access.json
Download History Raw 
{
  "trigger_id": "25889dcf67314fd2c2bcde95af393dc1",
  "playbook_id": "",
  "suggestion_reason": "Recommended for preventing unauthorized access to GCP Bucket",
  "description": "This CLI command requires 'storage.buckets.getIamPolicy' and 'storage.buckets.setIamPolicy' permissions. Successful execution will revoke 'allAuthenticatedUsers' permission access in GCP Storage buckets.",
  "trigger_name": "Remove GCP Bucket AllAuthenticatedUser Access",
  "automation_type": "command",
  "automation_id": "gcp-storage-bucket-policy-delete-remove-AllAuthenticatedUser-access-quick-action",
  "alerts_filter": {
    "filter": {
      "OR": [
        {
          "SEARCH_FIELD": "matching_service_rule_id",
          "SEARCH_TYPE": "EQ",
          "SEARCH_VALUE": "9f08e13c-cdd6-4ad1-89f5-ffef6a71e432"
        }
      ]
    }
  }
}