mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-01-31 15:53:33 +08:00
71 lines
2.3 KiB
YAML
71 lines
2.3 KiB
YAML
id: gcloud-bigquery-cmek-not-enabled
|
|
|
|
info:
|
|
name: BigQuery Dataset Encryption with Customer-Managed Encryption Keys Not Enabled
|
|
author: princechaddha
|
|
severity: high
|
|
description: |
|
|
Ensure that all your Google Cloud BigQuery datasets are encrypted using Customer-Managed Encryption Keys (CMEKs) in order to have a more granular control over the dataset encryption/decryption process. Datasets not encrypted with CMEKs may expose sensitive data to higher risks.
|
|
impact: |
|
|
Using Google-managed keys for dataset encryption limits control over the encryption process and may not meet compliance requirements that specify encryption key management policies.
|
|
remediation: |
|
|
Update the encryption configuration of your BigQuery datasets to use Customer-Managed Encryption Keys. This can be done by setting the 'defaultEncryptionConfiguration' property of each dataset to use a 'kmsKeyName' that you manage.
|
|
reference:
|
|
- https://cloud.google.com/bigquery/docs/customer-managed-encryption
|
|
tags: cloud,devops,gcp,gcloud,bigquery,gcp-cloud-config
|
|
|
|
flow: |
|
|
code(1)
|
|
for(let projectId of iterate(template.projectIds)){
|
|
set("projectId", projectId)
|
|
code(2)
|
|
for(let dataset of iterate(template.datasets)){
|
|
set("datasetId", dataset)
|
|
code(3)
|
|
}
|
|
}
|
|
|
|
self-contained: true
|
|
|
|
code:
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
gcloud projects list --format="json(projectId)"
|
|
extractors:
|
|
- type: json
|
|
name: projectIds
|
|
internal: true
|
|
json:
|
|
- '.[].projectId'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
bq ls --project_id $projectId --format="prettyjson"
|
|
|
|
extractors:
|
|
- type: json
|
|
name: datasets
|
|
internal: true
|
|
json:
|
|
- '.[] | .datasetReference.datasetId'
|
|
|
|
- engine:
|
|
- sh
|
|
- bash
|
|
source: |
|
|
bq show --format=prettyjson $projectId:$datasetId | jq '.defaultEncryptionConfiguration.kmsKeyName'
|
|
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- 'null'
|
|
|
|
extractors:
|
|
- type: dsl
|
|
dsl:
|
|
- '"Dataset without CMEK: " + datasetId + " in Project: " + projectId'
|
|
# digest: 4a0a004730450221009a940bc0e74b624a666bd31616a1c6271401d731875ab33a0da908d016dc5805022053028b9e545d9edddb5d9c5323ce52dc26a2baf3b756ce0086c36036eb1ed54e:922c64590222798bb761d5b6d8e72950 |