gcp-acm-access-level-node
match (record)
{
"field": "name",
"resource_type": "google.identity.accesscontextmanager.v1.AccessLevel"
}
emit
| source type | ConditionalPolicy |
|---|---|
| target type | ConditionalPolicy |
| source | <AccessPolicy ConditionalPolicy node> |
| target | <AccessLevel ConditionalPolicy node> |
| state logic | ACTIVE (unconditional structural fact — access level exists within the access policy). |
Narrative
Access policy {accesspolicy.name} defines Access Level {level.name} (device/IP/identity condition for ingress).
Raw rule rules/explicit/gcp-accesscontextmanager.yaml
id: gcp-acm-access-level-node
emits: HasPolicy
applies_to:
- gcp
match_record:
resource_type: google.identity.accesscontextmanager.v1.AccessLevel
field: name
emit:
source_type: ConditionalPolicy
target_type: ConditionalPolicy
source: <AccessPolicy ConditionalPolicy node>
target: <AccessLevel ConditionalPolicy node>
api_source: accesscontextmanager.accessLevels.list / .get
evidence_field: name, title, basic.conditions[] (ipSubnetworks, devicePolicy, members), custom.expr
annotate:
provider_type: google.identity.accesscontextmanager.v1.AccessLevel
has_device_policy: <true/false from basic.conditions[].devicePolicy>
has_ip_restriction: <true/false from basic.conditions[].ipSubnetworks>
has_identity_restriction: <true/false from basic.conditions[].members>
state_logic: "ACTIVE (unconditional structural fact \u2014 access level exists within the access policy)."
conditions: []
confidence: 1.0
derived_from:
- "accesscontextmanager.accessLevels.get \u2014 name, basic.conditions"
false_positive_note: Access levels without any ingressPolicies[] reference in an enforced perimeter
have no security effect on path traversal; emit the structural node regardless but do not model them
as guardrail conditions.
narrative: Access policy {accesspolicy.name} defines Access Level {level.name} (device/IP/identity condition
for ingress).