Cloud Storage 的预定义折叠状态（扩展）

本页面介绍了 Cloud Storage 预定义状况的 v1.0 版本（扩展）中包含的预防性和检测政策。此安全状况包含两个政策集：

  • 一个政策集，其中包含适用于 Cloud Storage 的组织政策。

  • 一个政策集，其中包含适用于 Cloud Storage 的 Security Health Analytics 检测器。

您可以使用此预定义状况来配置有助于保护 Cloud Storage 的安全状况。如果要部署此预定义状态，您必须自定义某些政策，以便它们应用于您的环境。

组织政策限制条件

下表介绍了此安全状况中包含的组织政策。

政策 说明 合规性标准
storage.publicAccessPrevention

此政策可防止 Cloud Storage 存储分区向未经身份验证的公开访问开放。

值为 true 可防止公开访问存储分区。

 NIST SP 800-53 控件：AC-3、AC-17 和 AC-20
storage.uniformBucketLevelAccess

此政策阻止 Cloud Storage 存储分区使用对象 ACL（与 IAM 政策不同的独立系统）来提供访问权限，从而在访问权限管理和审核方面实现一致性。

该值为 true，以强制执行统一存储桶级访问权限。

 NIST SP 800-53 控件：AC-3、AC-17 和 AC-20
storage.retentionPolicySeconds

此限制条件定义了存储分区的保留政策期限（以秒为单位）。

采用此预定义折叠状态时，您必须配置此值。

 NIST SP 800-53 控件：SI-12

Security Health Analytics 检测器

下表介绍了预定义状态中包含的 Security Health Analytics 检测器。如需详细了解这些检测器，请参阅漏洞发现结果。

检测器名称 说明
BUCKET_LOGGING_DISABLED

此检测器会检查是否存在未启用日志记录的存储桶。
LOCKED_RETENTION_POLICY_NOT_SET

此检测器会检查是否为日志设置了锁定的保留政策。
OBJECT_VERSIONING_DISABLED

此检测器会检查在具有接收器的存储分区中是否启用了对象版本控制。
BUCKET_CMEK_DISABLED

此检测器会检查存储分区是否使用客户管理的加密密钥 (CMEK) 进行加密。
BUCKET_POLICY_ONLY_DISABLED

此检测器会检查是否配置了统一存储桶级访问权限。
PUBLIC_BUCKET_ACL

此检测器会检查存储桶是否可公开访问。
PUBLIC_LOG_BUCKET

此检测器会检查带有日志接收器的存储桶是否可公开访问。
ORG_POLICY_LOCATION_RESTRICTION

此检测器会检查 Compute Engine 资源是否不符合 constraints/gcp.resourceLocations 限制条件。

YAML 定义

以下是 Cloud Storage 预定义状态的 YAML 定义。

name: organizations/123/locations/global/postureTemplates/cloud_storage_extended
description: Posture Template to make your Cloud storage workload secure.
revision_id: v.1.0
state: ACTIVE
policy_sets:
- policy_set_id: Cloud storage preventative policy set
  description: 3 org policies that new customers can automatically enable.
  policies:
  - policy_id: Enforce Public Access Prevention
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-17
    - standard: NIST SP 800-53
      control: AC-20
    constraint:
      org_policy_constraint:
        canned_constraint_id: storage.publicAccessPrevention
        policy_rules:
        - enforce: true
    description: This governance policy prevents access to existing and future resources via the public internet by disabling and blocking Access Control Lists (ACLs) and IAM permissions that grant access to allUsers and allAuthenticatedUsers.
  - policy_id: Enforce uniform bucket-level access
    compliance_standards:
    - standard: NIST SP 800-53
      control: AC-3
    - standard: NIST SP 800-53
      control: AC-17
    - standard: NIST SP 800-53
      control: AC-20
    constraint:
      org_policy_constraint:
        canned_constraint_id: storage.uniformBucketLevelAccess
        policy_rules:
        - enforce: true
    description: This boolean constraint requires buckets to use uniform bucket-level access where this constraint is set to TRUE.
  - policy_id: Retention policy duration in seconds
    compliance_standards:
    - standard: NIST SP 800-53
      control: SI-12
    constraint:
      org_policy_constraint:
        canned_constraint_id: storage.retentionPolicySeconds
        policy_rules:
        - enforce: true
    description: This list constraint defines the set of durations for retention policies that can be set on Cloud Storage buckets. By default, if no organization policy is specified, a Cloud Storage bucket can have a retention policy of any duration. The list of allowed durations must be specified as a positive integer value greater than zero, representing the retention policy in seconds. Any insert, update, or patch operation on a bucket in the organization resource must have a retention policy duration that matches the constraint. Enforcement of this constraint is not retroactive. When a new organization policy is enforced, the retention policy of existing buckets remains unchanged and valid.
- policy_set_id: Cloud storage detective policy set
  description: 8 SHA modules that new customers can automatically enable.
  policies:
  - policy_id: Bucket logging disabled
    constraint:
      securityHealthAnalyticsModule:
        moduleEnablementState: ENABLED
        moduleName: BUCKET_LOGGING_DISABLED
  - policy_id: Locked retention policy not set
    constraint:
      securityHealthAnalyticsModule:
        moduleEnablementState: ENABLED
        moduleName: LOCKED_RETENTION_POLICY_NOT_SET
  - policy_id: Object versioning disabled
    constraint:
      securityHealthAnalyticsModule:
        moduleEnablementState: ENABLED
        moduleName: OBJECT_VERSIONING_DISABLED
  - policy_id: Bucket CMEK disabled
    constraint:
      securityHealthAnalyticsModule:
        moduleEnablementState: ENABLED
        moduleName: BUCKET_CMEK_DISABLED
  - policy_id: Bucket policy only disabled
    constraint:
      securityHealthAnalyticsModule:
        moduleEnablementState: ENABLED
        moduleName: BUCKET_POLICY_ONLY_DISABLED
  - policy_id: Public bucket ACL
    constraint:
      securityHealthAnalyticsModule:
        moduleEnablementState: ENABLED
        moduleName: PUBLIC_BUCKET_ACL
  - policy_id: Public log bucket
    constraint:
      securityHealthAnalyticsModule:
        moduleEnablementState: ENABLED
        moduleName: PUBLIC_LOG_BUCKET
  - policy_id: Org policy location restriction
    constraint:
      securityHealthAnalyticsModule:
        moduleEnablementState: ENABLED
        moduleName: ORG_POLICY_LOCATION_RESTRICTION

后续步骤