Check for Publicly Shared Disk Images

01 Sign in to Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to examine from the console top navigation bar.

03 Navigate to Google Compute Engine console at https://console.cloud.google.com/compute.

04 In the navigation panel, select Images to access the list with all the virtual machine (VM) disk images available for the selected project.

05 Select the VM disk image that you want to examine, then click on the SHOW INFO PANEL button to show the image permissions.

06 Select the PERMISSIONS tab, type allAuthenticatedUsers in the Search members search box and press Enter. If the Google Compute Engine console returns one or more results, the selected virtual machine disk image is publicly shared with all other Google Cloud accounts.

07 Repeat step no. 5 and 6 for each virtual machine (VM) disk image created for the selected project.

08 Repeat steps no. 2 – 7 for each project deployed in your Google Cloud account.

01 Run projects list command (Windows/macOS/Linux) using custom query filters to list the IDs of all the Google Cloud Platform (GCP) projects available in your Google Cloud account:

gcloud projects list
	--format="table(projectId)"

02 The command output should return the requested GCP project IDs:

PROJECT_ID
cc-project5-123123
cc-web-repo-112233

03 Run compute images list command (Windows/macOS/Linux) using the ID of the GCP project that you want to examine as identifier parameter and custom query filters to list all the virtual machine (VM) disk images available for the selected project. Include the --no-standard-images parameter in the command request to disable listing any images from the public image projects:

gcloud compute images list
	--project cc-project5-123123
	--no-standard-images
	--format="table(name)"

04 The command output should return the name(s) of the disk images(s) created for the selected GCP project:

NAME
cc-project5-prod-image
cc-project5-data-image
cc-project5-kb10-image

05 Run compute images get-iam-policy command (Windows/macOS/Linux) using the name of the virtual machine disk image that you want to examine as identifier parameter and custom query filters to describe name of the IAM member(s) associated with the selected image:

gcloud compute images get-iam-policy cc-project5-prod-image
	--format=json | jq '.bindings[]'

06 The command output should return the name of the associated member(s):

"allAuthenticatedUsers"
"user:admin@cloudconformity.com"
"serviceAccount:123412341234-compute@developer.gserviceaccount.com"

07 Repeat step no. 5 and 6 for each virtual machine disk image created within the selected project.

08 Repeat steps no. 3 – 7 for each GCP project deployed in your Google Cloud account.

01 Sign in to Google Cloud Management Console.

02 Select the GCP project that you want to access from the console top navigation bar.

03 Navigate to Google Compute Engine console at https://console.cloud.google.com/compute.

04 In the navigation panel, select Images to access the list with all the virtual machine (VM) disk images available for the selected project.

05 Select the VM disk image that you want to reconfigure (see Audit section part I to identify the right image), then click on the SHOW INFO PANEL button to access the image permissions.

06 On the information panel, perform the following operations:

1. Select the PERMISSIONS tab to access the disk image permissions.
2. Expand the IAM role for which you want to remove the allAuthenticatedUsers member, then click on the delete icon next to the member name to remove it.
3. On the confirmation box, select the member that you want to delete, then click REMOVE to confirm the member removal.

07 Repeat step no. 5 and 6 to revoke access for other publicly shared VM disk images available in the selected project.

08 Repeat steps no. 2 – 7 for each GCP project created within your Google Cloud account.

01 Run compute images remove-iam-policy-binding command (Windows/macOS/Linux) using the name of the VM disk image that you want to reconfigure as identifier parameter (see Audit section part II to identify the right resource), to remove the "allAuthenticatedUsers" IAM member binding from the IAM policy associated with the selected disk image. The --role parameter value represents the IAM role for which you want to remove the allAuthenticatedUsers member. In the following example, the allAuthenticatedUsers member role is 'roles/editor':

gcloud compute images remove-iam-policy-binding cc-project5-prod-image
	--member='allAuthenticatedUsers'
	--role='roles/editor'

02 The command request should return the metadata for the reconfigured IAM policy:

Updated IAM policy for image [cc-project5-prod-image].
bindings:
- members:
  - user:admin@cloudconformity.com
  role: roles/compute.imageUser
- members:
  - serviceAccount:123412341234-compute@developer.gserviceaccount.com
  role: roles/owner
etag: abcdabcd
version: 1

03 Repeat step no. 1 and 2 to revoke access for other publicly shared virtual machine disk images created for the selected project.

04 Repeat steps no. 1 – 3 for each GCP project deployed within your Google Cloud account.