Description

Ensure that custom Compute Engine disk images do not grant the allUsers or allAuthenticatedUsers principal any IAM role (such as Compute Image User) that would make the image accessible to the public or to any authenticated Google account.

Rationale

A publicly shared custom disk image may expose sensitive information baked into the image, such as application code, configuration files, credentials, or proprietary software, to any Google Cloud user (or, if shared with allUsers, any internet user). Images should only be shared with specific, intended projects or identities within the organization.

Impact

  • Prevents exposure of proprietary software, configuration, or embedded credentials contained in a custom image

  • Restricts image usage to explicitly authorized projects and identities

  • Reduces the risk of an external party creating instances from an organization's custom image

Default Value

By default, newly created custom disk images are private and are not shared with allUsers or allAuthenticatedUsers.

Pre-Requisites

  • IAM permissions to view and edit IAM policies on Compute Engine images (e.g., Compute Image Admin)

Test Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Compute Engine > Storage > Images.

  4. Select the image to review, then open the Permissions tab.

  5. Review the list of principals granted access to the image.

  6. Verify that allUsers and allAuthenticatedUsers do not appear with any role.

  7. If either principal is present, follow the implementation steps.

Implementation Steps

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Compute Engine > Storage > Images and select the affected image.

  4. Open the Permissions tab.

  5. Locate the allUsers or allAuthenticatedUsers entry and select Remove access.

  6. Confirm the removal.

  7. If specific external projects legitimately require access, grant the Compute Image User role to their specific service accounts or project identities instead of using public principals.

Backout Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Compute Engine > Storage > Images and select the affected image.

  4. Open the Permissions tab and select Add principal.

  5. Add allUsers or allAuthenticatedUsers back with the Compute Image User role.

  6. Save the change.

Reference