Cloud Storage controls for generative AI use cases

The storage.publicAccessPrevention boolean constraint prevents access to existing and future resources over the internet. It disables and blocks access control lists (ACLs) and Identity and Access Management (IAM) permissions that grant access to allUsers and allAuthenticatedUsers .

The storage.uniformBucketLevelAccess boolean constraint requires buckets to use uniform bucket-level access. Uniform bucket-level access lets you only use bucket-level Identity and Access Management (IAM) permissions to grant access to your Cloud Storage resources.

An HMAC key is a long-lived type of credential that is associated with a service account or a user account in Cloud Storage. Use an HMAC key to create signatures that are included in requests to Cloud Storage. A signature proves a user or service account has authorized a request.

Unlike short-lived credentials (such as. OAuth 2.0 tokens), HMAC keys don't expire automatically and remain valid until manually revoked. HMAC keys are high-risk credentials: if compromised, they provide persistent access to your resources. You must ensure appropriate mechanisms are in place to help protect them.

Service accounts are non-human identities that are designed for applications, and their behavior is predictable and automated. Normally, service accounts don't need to itemize buckets, as they're already mapped. Therefore, if you detect a service account attempting to retrieve a list of all Cloud Storage buckets, investigate it immediately. Reconnaissance enumeration is often used as a recon technique by a malicious actor that has gained access to the service account.

Configure an alert that detects when a Cloud Storage bucket's IAM policy is modified to grant public access. This alert fires when the allUsers or allAuthenticatedUsers principals are added to a bucket's IAM policy. This alert is a critical, high-severity event because it can expose all data in the bucket. Investigate this alert immediately to confirm if the change was authorized or is a sign of a misconfiguration or malicious actor.

In the alert, set the data.protoPayload.serviceData.policyData.bindingDeltas.member JSON attribute to allUsers or allAuthenticatedUsers and the action to ADD .

Depending on your regulatory requirements, ensure that each Cloud Storage bucket retention policy is locked. Set the retention period to a timeframe that meets your requirements.

Apply lifecycle rules to each Cloud Storage bucket that has a SetStorageClass action type.

Ensure that lifecycle management of Cloud Storage is enabled and configured. The lifecycle control contains the configuration for the storage lifecycle. Verify that the policies in this setting match your requirements.

Ensure that lifecycle management rules for Cloud Storage are enabled and configured. The rule control contains the configuration for the storage lifecycle. Verify that the policies in this setting match your requirements.

Identify all objects where temporaryHold is set to TRUE and start an investigation and validation process. This evaluation is appropriate for the following use cases:

• Legal hold:To comply with legal requirements for storing data, temporary hold can be used to prevent the deletion of sensitive data that may be relevant to ongoing investigations or litigation.
• Data loss prevention:To prevent accidental deletion of important data, temporary hold can be used as a safety measure to protect critical business information.
• Content moderation:To review potentially sensitive or inappropriate content before it becomes publicly accessible, apply a temporary hold to content uploaded to Cloud Storage for further inspection and moderation decisions.

Ensure that all the Cloud Storage buckets have a retention policy.

Data classification is a foundational component of any data governance and security program. Applying a classification label with values like public, internal, confidential, or restricted to each bucket is essential.

Confirm that google_storage_bucket.labels has an expression for classification and create a violation if it doesn't.

Ensure that every Cloud Storage bucket includes a log bucket.

In Cloud Storage, storage.buckets/lifecycle.rule.action.type refers to the type of action to be taken on a specific object based on a lifecycle rule within a bucket. This configuration helps automate the management and lifecycle of your data stored in the cloud.

Configure the storage.buckets/lifecycle.rule.action.type to ensure that objects are permanently deleted from the bucket.

For deletion rules, ensure that the isLive condition of the rule is set to false .

In Cloud Storage, storage.buckets/lifecycle.rule.condition.isLive is a boolean condition that is used in lifecycle rules to determine whether an object is considered live. This filter helps ensure that actions within a lifecycle rule are applied only to desired objects based on their live status.

Use cases:

• Archive historical versions:Archive only non-current versions of objects to save storage costs while keeping the latest version readily accessible.
• Clean up deleted objects:Automate permanent deletion of objects that have been deleted by users, freeing up space in the bucket.
• Protect live data:Ensure that actions like setting temporary holds are applied only to live objects, preventing accidental modification of archived or deleted versions

Ensure that all Cloud Storage buckets have versioning enabled. Use cases include the following:

• Data protection and recovery:Protect against accidental data loss by preventing overwrites and enabling recovery of deleted or modified data.
• Compliance and auditing:Maintain a history of all object edits for regulatory compliance or internal auditing purposes.
• Version control:Track changes to files and data sets, enabling collaboration and rollback to previous versions if necessary.

Ensure that google_storage_bucket.labels has an expression for an owner.

Enable additional logging around particular storage objects based on their use case. For example, log access to sensitive data buckets so that you can trace who gained access and when. When enabling additional logging, consider the volume of logs that you might generate.