Skip to content

Commit 6cea799

Browse files
james-zhou-inspire11james-zhou-inspire11
committed
feat(CG-1294): add GCP CIS 1.30 1.18 rule
1 parent 751a65a commit 6cea799

3 files changed

Lines changed: 159 additions & 0 deletions

File tree

‎src/gcp/cis-1.3.0/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ Policy Pack based on the GCP Foundations 1.3.0 benchmark provided by the [Center
7272
| GCP CIS 1.15 | Ensure API keys are rotated every 90 days |
7373
| GCP CIS 1.16 | Ensure Essential Contacts is Configured for Organization |
7474
| GCP CIS 1.17 | Ensure that Dataproc Cluster is encrypted using CustomerManaged Encryption Key |
75+
| GCP CIS 1.18 | Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager |
7576
| GCP CIS 2.1 | Ensure that Cloud Audit Logging is configured properly across all services and all users from a project |
7677
| GCP CIS 2.2 | Ensure that sinks are configured for all log entries |
7778
| GCP CIS 2.3 | Ensure that retention policies on log buckets are configured using Bucket Lock |

‎src/gcp/cis-1.3.0/rules/gcp-cis-1.3.0-1.18.ts‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
/* eslint-disable @typescript-eslint/explicit-module-boundary-types */
2+
/* eslint-disable @typescript-eslint/no-explicit-any */
3+
4+
export default {
5+
id: 'gcp-cis-1.3.0-1.18',
6+
title: 'GCP CIS 1.18 Ensure Secrets are Not Stored in Cloud Functions Environment Variables by Using Secret Manager',
7+
description:
8+
'Google Cloud Functions allow you to host serverless code that is executed when an event is triggered, without the requiring the management a host operating system. These functions can also store environment variables to be used by the code that may contain authentication or other information that needs to remain confidential.',
9+
audit: `Determine if Confidential Information is Stored in your Functions in Cleartext
10+
11+
**From Console:**
12+
13+
1. Log in to the Google Cloud Web Portal (https://console.cloud.google.com/)
14+
2. Within the project you wish to audit, select the Navigation hamburger menu in the top left. Scroll down to under the heading 'Serverless', then select 'Cloud Functions'
15+
3. Click on a function name from the list
16+
4. Open the Variables tab and you will see both buildEnvironmentVariables and environmentVariables
17+
5. Review the variables whether they are secrets
18+
6. Repeat step 3-5 until all functions are reviewed
19+
20+
**From Command Line:**
21+
22+
1. To view a list of your cloud functions run
23+
24+
cloud functions list
25+
26+
2. For each cloud function in the list run the following command.
27+
28+
gcloud functions describe <function_name>
29+
30+
3. Review the settings of the buildEnvironmentVariables and environmentVariables. Determine if this is data that should not be publicly accessible.
31+
32+
Determine if Secret Manager API is 'Enabled' for your Project
33+
34+
**From Console**
35+
36+
1. Within the project you wish to audit, select the Navigation hamburger menu in the top left. Hover over 'APIs & Services' to under the heading 'Serverless', then select 'Enabled APIs & Services' in the menu that opens up.
37+
2. Click the button '+ Enable APIS and Services'
38+
3. In the Search bar, search for 'Secret Manager API' and select it.
39+
4. If it is enabled, the blue box that normally says 'Enable' will instead say 'Manage'.
40+
41+
**From Command Line:**
42+
43+
1. Within the project you wish to audit, run the following command.
44+
45+
gcloud services list
46+
47+
2. If 'Secret Manager API' is in the list, it is enabled.
48+
`,
49+
rationale:
50+
'It is recommended to use the Secret Manager, because environment variables are stored unencrypted, and accessible for all users who have access to the code.',
51+
remediation: `Enable Secret Manager API for your Project
52+
53+
**From Console:**
54+
55+
1. Within the project you wish to enable, select the Navigation hamburger menu in the top left. Hover over 'APIs & Services' to under the heading 'Serverless', then select 'Enabled APIs & Services' in the menu that opens up.
56+
2. Click the button '+ Enable APIS and Services'
57+
3. In the Search bar, search for 'Secret Manager API' and select it.
58+
4. Click the blue box that says 'Enable'.
59+
60+
**From Command Line:**
61+
62+
1. Within the project you wish to enable the API in, run the following command.
63+
64+
gcloud services enable Secret Manager API
65+
66+
Reviewing Environment Variables That Should Be Migrated to Secret Manager
67+
68+
**From Console:**
69+
70+
1. Log in to the Google Cloud Web Portal (https://console.cloud.google.com/)
71+
2. Go to Cloud Functions
72+
3. Click on a function name from the list
73+
4. Click on Edit and review the Runtime environment for variables that should be secrets. Leave this list open for the next step.
74+
75+
**From Command Line:**
76+
77+
1. To view a list of your cloud functions run
78+
79+
cloud functions list
80+
81+
2. For each cloud function run the following command.
82+
83+
gcloud functions describe <function_name>
84+
85+
3. Review the settings of the buildEnvironmentVariables and environmentVariables. Keep this information for the next step.
86+
87+
Migrating Environment Variables to Secrets within the Secret Manager
88+
89+
**From Console:**
90+
91+
1. Go to the Secret Manager page in the Cloud Console.
92+
2. On the Secret Manager page, click Create Secret.
93+
3. On the Create secret page, under Name, enter the name of the Environment Variable you are replacing. This will then be the Secret Variable you will reference in your code.
94+
4. You will also need to add a version. This is the actual value of the variable that will be referenced from the code. To add a secret version when creating the initial secret, in the Secret value field, enter the value from the Environment Variable you are replacing.
95+
5. Leave the Regions section unchanged.
96+
6. Click the Create secret button.
97+
7. Repeat for all Environment Variables
98+
99+
**From Command Line**
100+
101+
1. Run the following command with the Environment Variable name you are replacing in the *<secret-id>*. It is most secure to point this command to a file with the Environment Variable value located in it, as if you entered it via command line it would show up in your shell’s command history.
102+
103+
gcloud secrets create <secret-id> --data-file="/path/to/file.txt"
104+
105+
Granting your Runtime's Service Account Access to Secrets
106+
107+
**From Console**
108+
109+
1. Within the project containing your runtime login with account that has the 'roles/secretmanager.secretAccessor' permission.
110+
2. Select the Navigation hamburger menu in the top left. Hover over 'Security' to under the then select 'Secret Manager' in the menu that opens up.
111+
3. Click the name of a secret listed in this screen.
112+
4. If it is not already open, click Show Info Panel in this screen to open the panel.
113+
5.In the info panel, click Add principal.
114+
6.In the New principals field, enter the service account your function uses for its identity. (If you need help locating or updating your runtime's service account, please see the 'docs/securing/function-identity#runtime_service_account' reference.)
115+
5. In the Select a role dropdown, choose Secret Manager and then Secret Manager Secret Accessor.
116+
117+
**From Command Line**
118+
119+
As of the time of writing, using Google CLI to list Runtime variables is only in beta. Because this is likely to change we are not including it here.
120+
121+
Modifying the Code to use the Secrets in Secret Manager
122+
123+
**From Console**
124+
125+
This depends heavily on which language your runtime is in. For the sake of the brevity of this recommendation, please see the '/docs/creating-and-accessing-secrets#access' reference for language specific instructions.
126+
127+
**From Command Line**
128+
129+
This depends heavily on which language your runtime is in. For the sake of the brevity of this recommendation, please see the' /docs/creating-and-accessing-secrets#access' reference for language specific instructions.
130+
131+
Deleting the Insecure Environment Variables Be certain to do this step last. Removing variables from code actively referencing them will prevent it from completing successfully.
132+
133+
**From Console**
134+
135+
1. Select the Navigation hamburger menu in the top left. Hover over 'Security' then select 'Secret Manager' in the menu that opens up.
136+
2. Click the name of a function. Click Edit.
137+
3. Click Runtime, build and connections settings to expand the advanced configuration options.
138+
4. Click 'Security’. Hover over the secret you want to remove, then click 'Delete'.
139+
5. Click Next. Click Deploy. The latest version of the runtime will now reference the secrets in Secret Manager.
140+
141+
**From Command Line**
142+
143+
gcloud functions deploy <Function name>--remove-env-vars <env vars>
144+
145+
If you need to find the env vars to remove, they are from the step where ‘gcloud functions describe *<function_name>*’ was run.
146+
147+
**Default Value:**
148+
149+
By default Secret Manager is not enabled.
150+
`,
151+
references: [
152+
['https://cloud.google.com/functions/docs/configuring/env-var#managing_secrets'],
153+
['https://cloud.google.com/secret-manager/docs/overview'],
154+
],
155+
severity: 'unknown',
156+
}

‎src/gcp/cis-1.3.0/rules/index.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ import Gcp_CIS_130_114 from './gcp-cis-1.3.0-1.14'
1515
import Gcp_CIS_130_115 from './gcp-cis-1.3.0-1.15'
1616
import Gcp_CIS_130_116 from './gcp-cis-1.3.0-1.16'
1717
import Gcp_CIS_130_117 from './gcp-cis-1.3.0-1.17'
18+
import Gcp_CIS_130_118 from './gcp-cis-1.3.0-1.18'
1819
import Gcp_CIS_130_21 from './gcp-cis-1.3.0-2.1'
1920
import Gcp_CIS_130_22 from './gcp-cis-1.3.0-2.2'
2021
import Gcp_CIS_130_23 from './gcp-cis-1.3.0-2.3'
@@ -93,6 +94,7 @@ export default [
9394
Gcp_CIS_130_115,
9495
Gcp_CIS_130_116,
9596
Gcp_CIS_130_117,
97+
Gcp_CIS_130_118,
9698
Gcp_CIS_130_21,
9799
Gcp_CIS_130_22,
98100
Gcp_CIS_130_23,

0 commit comments

Comments
 (0)