The GCP environment contains security misconfigurations in both storage access controls and monitoring response configuration. The log archive bucket does not explicitly enforce Public Access Prevention, instead relying on inherited project or organisation settings. This can result in unintended public exposure if higher-level controls are weakened, missing, or changed later. Additionally, the Cloud Monitoring alert policy for bucket access events has no notification channels configured, meaning security-relevant alerts may trigger in the console without notifying the security team. Together, these issues reduce both preventative protection and incident response visibility, increasing the risk of undetected unauthorised access to sensitive log data.

Remediation:

Explicitly set the bucket’s public_access_prevention value to "enforced" and configure at least one valid notification channel for the alert policy, such as email, PagerDuty, Slack, or another security operations contact path. Security tests should verify that public access prevention is enforced and that alert policies contain one or more notification channels.

Metadata

• Severity: high
• Slug: gcp-security-misconfiguration

Tags

• GCP

CWEs

• 693: Protection Mechanism Failure
• 732: Incorrect Permission Assignment for Critical Resource

OWASP

• A05:2021: Security Misconfiguration