When using Cloud Run Jobs (I'd assume any service running Cloud Build under the hood as well), dedicated artifact buckets are created. Their naming is usually something like: us.artifacts.project.appspot.com
. With directory /containers/images/
and files like sha256:<checksum>
.
Is there a way to prevent such buckets from having Access Policy set as Fine Grained by default? Instead they should use Uniform, which is the one recommended. (ref1-cis_v120_5_2, ref2, ref3) Not only such access policy is hard to manage on a larger scale (in my case at least), but SCC is reporting findings on such buckets.
Most preferably I would like to set a flag on org or folder level making such Cloud Build Buckets be always created with Uniform access policy. I have not attempted to update the access policy manually (neither I've considered automated update) as this does not sound like an optimal solution to a problem which shouldn't exist in the first place. A very insecure workaround would be muting SCC alerts from category 'BUCKET_POLICY_ONLY_DISABLED' related to appspot.com buckets (if that field would even be accessible for muting rules)
You can enforce this organization policy on your project (or your folder or the entire organization: Enforce uniform bucket-level access