|
| 1 | +--- |
| 2 | +pcx_content_type: reference |
| 3 | +title: Google Cloud Platform (GCP) Cloud Storage |
| 4 | +rss: file |
| 5 | +--- |
| 6 | + |
| 7 | +import { Render } from "~/components"; |
| 8 | + |
| 9 | +<Render |
| 10 | + file="casb/integration-description" |
| 11 | + params={{ |
| 12 | + integrationName: "Google Cloud Platform (GCP) Cloud Storage", |
| 13 | + integrationAccountType: "GCP account", |
| 14 | + }} |
| 15 | +/> |
| 16 | + |
| 17 | +## Integration prerequisites |
| 18 | + |
| 19 | +- A GCP account using Cloud Storage. |
| 20 | +- For initial setup, access to the GCP account with permission to create a new Service Account with the scopes listed below. |
| 21 | + |
| 22 | +## Integration permissions |
| 23 | + |
| 24 | +For the GCP Cloud Storage integration to function, Cloudflare CASB requires the following access scopes via a Service Account: |
| 25 | + |
| 26 | +- `roles/viewer` |
| 27 | +- `roles/storage.admin` |
| 28 | + |
| 29 | +These permissions follow the principle of least privilege to ensure that only the minimum required access is granted. To learn more about each permission scope, refer to the [GCP IAM roles for Cloud Storage documentation](https://cloud.google.com/storage/docs/access-control/iam-roles). |
| 30 | + |
| 31 | +## Compute account |
| 32 | + |
| 33 | +You can connect a GCP compute account to your CASB integration to perform [Data Loss Prevention](/cloudflare-one/policies/data-loss-prevention/) scans within your Cloud Storage bucket and avoid data egress. CASB will scan any objects that exist in the bucket at the time of configuration. |
| 34 | + |
| 35 | +### Add a compute account |
| 36 | + |
| 37 | +To connect a compute account to your GCP integration: |
| 38 | + |
| 39 | +1. In [Zero Trust](https://one.dash.cloudflare.com), go to **CASB** > **Integrations**. |
| 40 | +2. Find and select your GCP integration. |
| 41 | +3. Select **Open connection instructions**. |
| 42 | +4. Follow the instructions provided to connect a new compute account. |
| 43 | +5. Select **Refresh**. |
| 44 | + |
| 45 | +You can only connect one compute account to an integration. To remove a compute account, select **Manage compute accounts**. |
| 46 | + |
| 47 | +### Configure compute account scanning |
| 48 | + |
| 49 | +Once your GCP compute account has successfully connected to your CASB integration, you can configure where and how to scan for sensitive data: |
| 50 | + |
| 51 | +1. In [Zero Trust](https://one.dash.cloudflare.com), go to **CASB** > **Integrations**. |
| 52 | +2. Find and select your GCP integration. |
| 53 | +3. Select **Create new configuration**. |
| 54 | +4. In **Resources**, choose the buckets you want to scan. Select **Continue**. |
| 55 | +5. Choose the file types, sampling percentage, and [DLP profiles](/cloudflare-one/policies/data-loss-prevention/dlp-profiles/) to scan for. |
| 56 | +6. (Optional) Configure additional settings, such as the limit of API calls over time for CASB to adhere to. |
| 57 | +7. Select **Continue**. |
| 58 | +8. Review the details of the scan, then select **Start scan**. |
| 59 | + |
| 60 | +CASB will take up to one hour to begin scanning. To view the scan results, go to **CASB** > **Content** > **Cloud**. |
| 61 | + |
| 62 | +To manage your resources, go to **CASB** > **Integrations**, then find and select your GCP integration. From here, you can pause all or individual scans, add or remove resources, and change scan settings. |
| 63 | + |
| 64 | +For more information, refer to [Content findings](/cloudflare-one/applications/casb/manage-findings/#content-findings). |
| 65 | + |
| 66 | +## Security findings |
| 67 | + |
| 68 | +<Render |
| 69 | + file="casb/security-findings" |
| 70 | + params={{ |
| 71 | + integrationName: "GCP Cloud Storage", |
| 72 | + slugRelativePath: "gcp-cloud-storage", |
| 73 | + }} |
| 74 | +/> |
| 75 | + |
| 76 | +### Cloud Storage Bucket security |
| 77 | + |
| 78 | +Flag security issues in Cloud Storage Buckets, including overpermissioning, access policies, and user security best practices. |
| 79 | + |
| 80 | +| Finding type | FindingTypeID | Severity | |
| 81 | +| -------------------------------------------------------------------------------- | -------------------------------------- | -------- | |
| 82 | +| Google Cloud Platform: GCS Bucket Allows Public Write | `4583f5a9-a343-4e2f-a8b3-9237a911f337` | Critical | |
| 83 | +| Google Cloud Platform: GCS Bucket IAM Policy Allows Public Access | `032c1e88-0cff-47f6-8d75-046e0a7330de` | Critical | |
| 84 | +| Google Cloud Platform: GCS Bucket Publicly Accessible | `cc028a95-46d4-4156-ac11-bc5713529824` | Critical | |
| 85 | +| Google Cloud Platform: Public Access Prevention Enabled But Policy Grants Public | `cc02680e-9cc3-49d1-99d5-29d425bf142f` | Critical | |
| 86 | +| Google Cloud Platform: GCS Bucket ACL Grants All Authenticated Users Access | `e1a588af-0500-482e-b59d-fd2693ce7fc0` | Critical | |
| 87 | +| Google Cloud Platform: GCS Bucket ACL Grants All Users Public Access | `1904c004-8d4f-470e-9460-e77db23d6a86` | Critical | |
| 88 | +| Google Cloud Platform: Public Access Prevention but ACL Grants allUsers | `fcf2e27e-673f-4cd2-9b76-ec89c4c5872c` | Critical | |
| 89 | +| Google Cloud Platform: GCS Bucket Versioning Disabled | `bd66e214-f205-4e00-bd68-121dad0a7988` | High | |
| 90 | +| Google Cloud Platform: GCS Bucket Without KMS Encryption | `0105d9c4-1a01-4b65-b33e-df6c55905147` | High | |
| 91 | +| Google Cloud Platform: GCS Uniform Bucket-Level Access Disabled | `6960b459-aa9e-4b41-84f6-26cdb75a1995` | High | |
| 92 | +| Google Cloud Platform: GCS Bucket IAM Policy Allows Public Read | `10420f34-8fdd-49cb-8d38-096a2de5824f` | High | |
| 93 | +| Google Cloud Platform: GCS Bucket Lacks Lifecycle Rules | `edcd5a8b-b128-404b-8207-23a80f669b65` | Medium | |
| 94 | +| Google Cloud Platform: GCS Bucket Logging Disabled | `d26f43c8-9406-481c-8c8b-1a7f05f3cc27` | Medium | |
| 95 | +| Google Cloud Platform: GCS Bucket Not Using 'Soft Delete' | `5542ed8e-77a6-43c1-8b9e-935e66009d34` | Medium | |
| 96 | +| Google Cloud Platform: GCS Bucket Retention Policy Disabled | `2d4a247c-8adb-4f2b-ae58-3568d633cb81` | Medium | |
| 97 | +| Google Cloud Platform: GCS Bucket IAM Policy Not Version 3 | `ade2ede6-08c7-4962-b084-f6a29ee4a5b8` | Low | |
| 98 | +| Google Cloud Platform: GCS Bucket IAM Policy Using Legacy Roles | `11a592b9-4f51-4a1a-9925-a48a5ed01521` | Low | |
0 commit comments