Google Cloud Platform (GCP)

Publicly Accessible Cloud Storage Bucket

Severity: High

What it means

A Google Cloud Storage bucket is accessible to the public internet. Anyone with the URL can download the files. This is a common source of data leaks.

How to fix

1. Go to Google Cloud Console > Cloud Storage > Buckets.

2. Select the bucket.

3. Go to the Permissions tab.

4. Remove any entries for allUsers or allAuthenticatedUsers.

5. To prevent future public access: go to the bucket's Settings and enable Prevent public access.

IAM Primitive Roles in Use

Severity: Medium

What it means

Someone in your GCP organization is using primitive roles (Owner, Editor, or Viewer). These are very broad: "Editor" for example grants write access to almost everything in the project. Google recommends using predefined roles instead, which give only the specific permissions needed.

How to fix

1. Go to Google Cloud Console > IAM & Admin > IAM.

2. Identify users/service accounts with Owner, Editor, or Viewer roles.

3. Replace them with more specific predefined roles (e.g., roles/storage.admin instead of Editor).

4. Use the IAM Recommender to get suggestions for right-sizing permissions.

Cloud SQL Public Access

Severity: High

What it means

Your Cloud SQL database instance allows connections from any IP address on the internet (0.0.0.0/0). This exposes the database to brute-force attacks and exploitation of any vulnerabilities.

How to fix

1. Go to Google Cloud Console > SQL > select your instance.

2. Go to Connections > Networking.

3. Under Authorized networks, remove 0.0.0.0/0 or any overly broad CIDR range.

4. Add only the specific IP addresses that need access.

5. Better yet, use Cloud SQL Auth Proxy or Private IP to connect securely without exposing the instance publicly.