gcp-acm-perimeter-blocks-project
match (record)
{
"field": "status.resources",
"resource_type": "google.identity.accesscontextmanager.v1.ServicePerimeter"
}
where
perimeter is ENFORCED (status.resources[] non-empty)
perimeterType == 'PERIMETER_TYPE_REGULAR'
emit
| source type | Project |
|---|---|
| target type | ConditionalPolicy |
| source | <Project node for each projects/<number> in status.resources[]> |
| target | <ServicePerimeter ConditionalPolicy node> |
| state logic | ACTIVE when the perimeter is enforced (status.resources[] non-empty, perimeterType REGULAR). |
Narrative
Project {project.name} is inside ServicePerimeter {perimeter.name} - cross-perimeter API calls to restricted services from outside are blocked.
Raw rule rules/explicit/gcp-accesscontextmanager.yaml
id: gcp-acm-perimeter-blocks-project
emits: HasPolicy
applies_to:
- gcp
match_record:
resource_type: google.identity.accesscontextmanager.v1.ServicePerimeter
field: status.resources
where:
- perimeter is ENFORCED (status.resources[] non-empty)
- perimeterType == 'PERIMETER_TYPE_REGULAR'
emit:
source_type: Project
target_type: ConditionalPolicy
source: <Project node for each projects/<number> in status.resources[]>
target: <ServicePerimeter ConditionalPolicy node>
api_source: "accesscontextmanager.servicePerimeters.get \u2014 status.resources[]"
evidence_field: status.resources[N]
annotate:
inside_perimeter: true
state_logic: ACTIVE when the perimeter is enforced (status.resources[] non-empty, perimeterType REGULAR).
conditions: []
confidence: 0.95
derived_from:
- "accesscontextmanager.servicePerimeters.get \u2014 status.resources[]"
false_positive_note: "Do not emit for dry-run-only or bridge perimeters. This edge carries guardrail\
\ semantics \u2014 the ServicePerimeter blocks cross-perimeter data access; downstream CanReadData/CanExfiltrate\
\ edges crossing this perimeter should be marked BLOCKED."
narrative: "Project {project.name} is inside ServicePerimeter {perimeter.name} \u2014 cross-perimeter\
\ API calls to restricted services from outside are blocked."