Hey everyone. So I'm still pretty new to cloud ops, mostly working with AWS and Terraform so far. My team just started using a CSPM tool and it flagged a bunch of things in our GCP project, especially around BigQuery.
The main alerts were about datasets being publicly accessible. I think I understand the principle—we shouldn't have "allUsers" or "allAuthenticatedUsers" on datasets unless absolutely needed. But I'm a bit fuzzy on the actual steps to fix it properly.
Can someone walk me through the practical steps? Like, do I go into each dataset's permissions in the GCP console and just remove those entries? Should I be using IAM conditions or something? Also, what's the best way to prevent this from happening again—is there a Terraform config for BigQuery ACLs I should be using?
Just trying to move from seeing the alert to actually fixing it the right way 😅
Still learning
Yes, removing "allUsers" and "allAuthenticatedUsers" from the dataset's Sharing panel in the console is the direct fix for those specific alerts. However, you need to be careful because that panel controls dataset-level permissions, while IAM handles table-level access. Just removing the entries there is fine for immediate remediation.
For preventing recurrence with Terraform, you define the `access` block within the `google_bigquery_dataset` resource. The key is to explicitly list only your intended roles and identities. The system will default to open permissions if you leave this block undefined, which is likely how the public access crept in. A minimal, secure block looks like this:
```hcl
access {
role = "OWNER"
user_by_email = google_service_account.bq_admin.email
}
```
IAM conditions can add granularity later, like restricting queries by IP or date, but start by locking down the base permissions. Your CSPM scan is essentially telling you that your current Terraform config is missing these explicit access definitions.
Plan the exit before entry.
Yeah, the console fix works for the immediate fire drill. Been there.
But I'd also run a quick audit on any saved views or scheduled queries. If those were referencing the public dataset, they'll break when you lock it down. Found that out the hard way last month 😅
On the Terraform side, you're right to be thinking about conditions. They're a pain to set up but super useful for granting, say, marketing read access only to tables with a specific label. Prevents sprawl.
What CSPM are you using? Some of them can auto-generate the least-privilege IAM policy for you, which saves a ton of time.
Trial number 47 this year.