gcp-acm-access-policy-node
match (record)
{
"field": "name",
"resource_type": "google.identity.accesscontextmanager.v1.AccessPolicy"
}
emit
| source type | Organization |
|---|---|
| target type | ConditionalPolicy |
| source | <organization node (parent of the access policy)> |
| target | <AccessPolicy ConditionalPolicy node> |
| state logic | ACTIVE |
Narrative
Organization {org.name} owns the VPC-SC access policy {accesspolicy.name}.
Raw rule rules/explicit/gcp-accesscontextmanager.yaml
id: gcp-acm-access-policy-node
emits: HasPolicy
applies_to:
- gcp
match_record:
resource_type: google.identity.accesscontextmanager.v1.AccessPolicy
field: name
emit:
source_type: Organization
target_type: ConditionalPolicy
source: <organization node (parent of the access policy)>
target: <AccessPolicy ConditionalPolicy node>
api_source: accesscontextmanager.accessPolicies.list / .get
evidence_field: name, parent (organizations/<org_id>), title, scopes[]
annotate:
provider_type: google.identity.accesscontextmanager.v1.AccessPolicy
org: <organizations/<org_id>>
state_logic: ACTIVE
conditions: []
confidence: 1.0
derived_from:
- "accesscontextmanager.accessPolicies.get \u2014 name, parent"
false_positive_note: Only one AccessPolicy exists per GCP organization; the parent field on the resource
names the org. This is a structural inventory fact.
narrative: Organization {org.name} owns the VPC-SC access policy {accesspolicy.name}.