google-cloud-platformgoogle-cloud-rungoogle-cloud-buildaccess-controlbucket

Cloud Run/Build artifacts buckets are created with Fine Grained access policy by default


When using Cloud Run Jobs (I'd assume any service running Cloud Build under the hood as well), dedicated artifact buckets are created. Their naming is usually something like: us.artifacts.project.appspot.com. With directory /containers/images/ and files like sha256:<checksum>.

Is there a way to prevent such buckets from having Access Policy set as Fine Grained by default? Instead they should use Uniform, which is the one recommended. (ref1-cis_v120_5_2, ref2, ref3) Not only such access policy is hard to manage on a larger scale (in my case at least), but SCC is reporting findings on such buckets.

Most preferably I would like to set a flag on org or folder level making such Cloud Build Buckets be always created with Uniform access policy. I have not attempted to update the access policy manually (neither I've considered automated update) as this does not sound like an optimal solution to a problem which shouldn't exist in the first place. A very insecure workaround would be muting SCC alerts from category 'BUCKET_POLICY_ONLY_DISABLED' related to appspot.com buckets (if that field would even be accessible for muting rules)


Solution

  • You can enforce this organization policy on your project (or your folder or the entire organization: Enforce uniform bucket-level access

    enter image description here