gcp-acm-ingress-rule-references-access-level
match (record)
{
"field": "status.ingressPolicies",
"resource_type": "google.identity.accesscontextmanager.v1.ServicePerimeter"
}
where
perimeter is ENFORCED: status.resources[] non-empty AND perimeterType REGULAR
ingressPolicies[].ingressFrom.sources[].accessLevel is non-empty
emit
| source type | ConditionalPolicy |
|---|---|
| target type | ConditionalPolicy |
| source | <ServicePerimeter ConditionalPolicy node> |
| target | <AccessLevel ConditionalPolicy node referenced by the ingress rule> |
| state logic | ACTIVE when referenced perimeter is enforced (status non-empty, perimeterType REGULAR). |
Narrative
ServicePerimeter {perimeter.name} ingress rule requires Access Level {level.name} - this access level is a condition on the perimeter's ingress path.
Raw rule rules/explicit/gcp-accesscontextmanager.yaml
id: gcp-acm-ingress-rule-references-access-level
emits: HasPolicy
applies_to:
- gcp
match_record:
resource_type: google.identity.accesscontextmanager.v1.ServicePerimeter
field: status.ingressPolicies
where:
- 'perimeter is ENFORCED: status.resources[] non-empty AND perimeterType REGULAR'
- ingressPolicies[].ingressFrom.sources[].accessLevel is non-empty
emit:
source_type: ConditionalPolicy
target_type: ConditionalPolicy
source: <ServicePerimeter ConditionalPolicy node>
target: <AccessLevel ConditionalPolicy node referenced by the ingress rule>
api_source: "accesscontextmanager.servicePerimeters.get \u2014 status.ingressPolicies[].ingressFrom.sources[].accessLevel"
evidence_field: status.ingressPolicies[N].ingressFrom.sources[M].accessLevel
state_logic: ACTIVE when referenced perimeter is enforced (status non-empty, perimeterType REGULAR).
conditions: []
confidence: 0.9
derived_from:
- "accesscontextmanager.servicePerimeters.get \u2014 status.ingressPolicies[].ingressFrom.sources[].accessLevel"
false_positive_note: Do not emit for dry-run-only perimeters (status absent or empty) or PERIMETER_TYPE_BRIDGE.
The access level is only a guardrail condition when the perimeter is ENFORCED.
narrative: "ServicePerimeter {perimeter.name} ingress rule requires Access Level {level.name} \u2014\
\ this access level is a condition on the perimeter's ingress path."