id: gcloud-public-access-prevention-not-enabled

info:
  name: Enforce Public Access Prevention for Cloud Storage Buckets
  author: princechaddha
  severity: high
  description: |
    Ensure that the Public Access Prevention feature is enabled for your Google Cloud Storage buckets to restrict public access and protect sensitive data from accidental or malicious exposure.
  impact: |
    Without Public Access Prevention, sensitive data stored in your Cloud Storage buckets may be publicly accessible, leading to potential data breaches.
  remediation: |
    Enable the Public Access Prevention feature for your Cloud Storage buckets to restrict public access and secure your data.
  reference:
    - https://cloud.google.com/storage/docs/public-access-prevention
  tags: cloud,devops,gcp,gcloud,google-cloud-storage,security,public-access-prevention,gcp-cloud-config

flow: |
  code(1)
  for(let projectId of iterate(template.projectIds)){
    set("projectId", projectId)
    code(2)
    for(let bucketName of iterate(template.buckets)){
      set("bucketName", bucketName)
      code(3)
    }
  }

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      gcloud projects list --format="json(projectId)"

    extractors:
      - type: json
        name: projectIds
        internal: true
        json:
          - '.[].projectId'

  - engine:
      - sh
      - bash
    source: |
      gcloud storage buckets list --project $projectId --format="json(name)"

    extractors:
      - type: json
        name: buckets
        internal: true
        json:
          - '.[].name'

  - engine:
      - sh
      - bash
    source: |
      gcloud storage buckets describe gs://$bucketName --format="json(public_access_prevention)" | jq -r '. // "null"'

    matchers:
      - type: word
        words:
          - 'inherited'

    extractors:
      - type: dsl
        dsl:
          - '"Public Access Prevention is not enabled for the bucket " + bucketName + " in project " + projectId'
# digest: 4a0a00473045022100c1b3ec23ade491f0feed95fabd9d6ddc0497ca798fc90e87e937354910e9fc79022061180eaadc90af9f7270297bfafaad491d57c30b6f5af1eee12f047e5e3c2885:922c64590222798bb761d5b6d8e72950