Check for Publicly Accessible Artifact Registry Repositories

Risk Level: High (act today)

Rule ID: ArtifactRegistry-002

Identify any publicly accessible Artifact Registry repositories within your Google Cloud Platform (GCP) account and update their IAM policy in order to protect against unauthorized access. To deny access from anonymous and public users, remove the bindings for allUsers and allAuthenticatedUsers members from the IAM policy associated with your repository. allUsers is a special member identifier that represents any user on the Internet, including authenticated and unauthenticated users, while the allAuthenticatedUsers is an identifier that represents any user or service account that can sign in to Google Cloud Platform (GCP) with a Google account.

This rule resolution is part of the Conformity Security & Compliance tool for GCP.

Security

Misconfigured access permissions are a common security vulnerability that involves Google Cloud resources. Artifact Registry lets you store code and dependencies for your cloud applications. However, it's vital to secure access if your repositories contain sensitive information like passwords, personal details (such as PII), or confidential data. To prevent sensitive data leaks and data loss, ensure that anonymous and/or public access to your Artifact Registry repositories is not allowed.

Audit

To determine if there are any publicly accessible Artifact Registry repositories available in your GCP account, perform the following operations:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to examine from the console top navigation bar.

03 Navigate to Artifact Registry console available at https://console.cloud.google.com/artifacts/.

04 In the left navigation panel, under Artifact Registry, choose Repositories to access the list of Artifact Registry repositories available for the selected GCP project.

05 Select the repository that you want to examine, choose SHOW INFO PANEL from the top-right menu, and select the PERMISSIONS tab to access the permissions defined for selected resource. The panel with the repository permissions opens.

06 Check for any allUsers and allAuthenticatedUsers principals. Click inside the Filter box, select Role / Member, type allUsers, and press Enter. Click again in the Filter box, choose OR, select Role / Member, type allAuthenticatedUsers, and press Enter. If the Google Cloud console returns one or more results (i.e., principals), the selected Artifact Registry repository is considered publicly accessible.

07 Repeat steps no. 5 and 6 for each Artifact Registry repository available within the selected GCP project.

08 Repeat steps no. 2 - 7 for each project deployed within your Google Cloud account.

Using GCP CLI

01 Run projects list command (Windows/macOS/Linux) with custom output filters to list the ID of each project available in your Google Cloud Platform (GCP) account:

gcloud projects list
	--format="table(projectId)"

02 The command output should return the requested GCP project IDs:

PROJECT_ID
cc-web-project-123123
cc-iot-project-112233

03 Run artifacts repositories list command (Windows/macOS/Linux) with the ID of the GCP project that you want to examine as the identifier parameter and custom output filters to describe the name and the location of each Artifact Registry repository available in the selected project:

gcloud artifacts repositories list
	--project cc-web-project-123123
	--format="(REPOSITORY,LOCATION)"

04 The command output should return the repository names and their location:

ARTIFACT_REGISTRY

REPOSITORY: cloud-run-source-deploy
LOCATION: us-central1

REPOSITORY: cc-project5-artifact-repo
LOCATION: us-central1

05 Run artifacts repositories get-iam-policy command (Windows/macOS/Linux) with the name of the Artifact Registry repository that you want to examine as the identifier parameter, to describe name of the IAM members (principals) defined within the IAM policy associated with the selected repository:

gcloud artifacts repositories get-iam-policy cloud-run-source-deploy
	--project cc-web-project-123123
	--location us-central1
	--format=json | jq '.bindings[].members[]'

06 The command output should return the names of the associated principals:

"allUsers"
"allAuthenticatedUsers"

If the list of IAM members (principals) returned by the artifacts repositories get-iam-policy command output includes "allUsers" and/or "allAuthenticatedUsers", as shown in the example above, the selected Artifact Registry repository is considered publicly accessible.

07 Repeat steps no. 5 and 6 for each Registry repository repository available in the selected GCP project.

08 Repeat steps no. 3 – 7 for each GCP project deployed in your Google Cloud account.

Remediation / Resolution

To remove the allUsers and/or allAuthenticatedUsers IAM member bindings from the IAM policy associated with your Artifact Registry repository in order to protect against unauthorized access, perform the following operations:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar.

03 Navigate to Artifact Registry console available at https://console.cloud.google.com/artifacts/.

04 In the left navigation panel, under Artifact Registry, choose Repositories to access the list of Artifact Registry repositories available for the selected GCP project.

05 Select the repository that you want to configure, choose SHOW INFO PANEL from the top-right menu, and select the PERMISSIONS tab to access the permissions defined for selected resource. The panel with the repository permissions opens.

06 In the Role / Principal section, identify and remove all allUsers and allAuthenticatedUsers principals from the role bindings configured for the selected repository by using the Delete button (bin icon) available next to each principal.

07 Inside the Remove role from principal? confirmation box, choose REMOVE to remove the allUsers and/or allAuthenticatedUsers role bindings.

08 Access to Artifact Registry repositories can be granted to specific, trusted users, groups, or service accounts that require it, following the Principle of Least Privilege (POLP). To assign a new role, perform the following actions:

On the PERMISSIONS panel, choose ADD PRINCIPAL.
For Add principals, enter the name of the trusted member/principal in the New principals box.
For Assign roles, use the Select a role dropdown box to search and select the role that you want to assign.
Choose SAVE to apply the changes.

09 Repeat steps no. 5 - 8 for each Artifact Registry repository that you want to configure, available within the selected GCP project.

10 Repeat steps no. 2 – 9 for each project deployed in your Google Cloud account.

Using GCP CLI

01 Run artifacts repositories remove-iam-policy-binding command (OSX/Linux/UNIX) with the name of the publicly accessible Artifact Registry repository that you want to configure as the identifier parameter, to remove the allUsers binding from the IAM policy associated with the selected repository:

gcloud artifacts repositories remove-iam-policy-binding cloud-run-source-deploy
	--location='us-central1'
	--member='allUsers'
	--role='roles/editor'

02 The command output should return the information available for the updated policy:

Updated IAM policy for repository [cloud-run-source-deploy].
bindings:
- members:
	- allAuthenticatedUsers
	role: roles/owner
etag: ABCD1234ABCD
version: 1

03 Run artifacts repositories remove-iam-policy-binding command (OSX/Linux/UNIX) with the name of the publicly accessible Artifact Registry repository that you want to configure as the identifier parameter, to remove the allAuthenticatedUsers binding from the IAM policy of the selected repository:

gcloud artifacts repositories remove-iam-policy-binding cloud-run-source-deploy
	--location='us-central1'
	--member='allAuthenticatedUsers'
	--role='roles/owner'

04 The command output should return the information available for the updated policy:

Updated IAM policy for service [cloud-run-source-deploy].
etag: 1234ABCD1234
version: 1

05 Access to Artifact Registry repositories can be granted to specific, trusted users, groups, or service accounts that require it, following the Principle of Least Privilege (POLP). To assign a new role to your Artifact Registry repository, run the artifacts repositories add-iam-policy-binding command (OSX/Linux/UNIX). This command adds a new role policy binding that allows the specified, trusted member/principal to access your repository. Trusted principals can be are users, groups, domains, or service accounts:

gcloud artifacts repositories add-iam-policy-binding cloud-run-source-deploy
	--location='us-central1'
	--member='user:user@domain.com'
	--role='roles/editor'

06 The command output should return the information available for the new role policy binding:

bindings:
- members:
	- user:user@domain.com
	role: roles/editor
etag: 1234ABCD1234
version: 1

07 Repeat steps no. 1 - 6 for each Artifact Registry repository that you want to configure, available in the selected GCP project.

08 Repeat steps no. 1 – 7 for each GCP project deployed in your Google Cloud account.

References

Google Cloud Platform (GCP) Documentation
Repository overview
View and list repositories
Update repository settings

GCP Command Line Interface (CLI) Documentation
gcloud projects list
gcloud artifacts repositories list
gcloud artifacts repositories get-iam-policy
gcloud artifacts repositories remove-iam-policy-binding
gcloud artifacts repositories add-iam-policy-binding

Publication date May 1, 2024

Audit

Using GCP Console

Using GCP CLI

Remediation / Resolution

Using GCP Console

Using GCP CLI

References

Related ArtifactRegistry rules