gcp-appengine-exposed-internet
A serving App Engine version is reachable at its appspot.com URL (modeled as a PublicEndpoint node) unless ingress-restricted.
match (record)
{
"field": "servingStatus",
"resource_type": "google.appengine.Version"
}
where
version.servingStatus == SERVING
no restrictive appengine.firewall ingress rule denies public source ranges AND app not IAP-gated
source is the appspot.com URL
PublicEndpoint node for the service/version (schema ExposedToInternet.source includes PublicEndpoint), NOT the Version/ApplicationPlatform node
emit
| target type | AnonymousIdentity |
|---|---|
| source | <appspot.com URL PublicEndpoint> |
| target | <AnonymousIdentity> |
| conditions | network_reachability |
| state logic | ACTIVE if default ingress firewall (allow *) and no IAP; else BLOCKED if a deny-all ingress rule or IAP restricts access. |
Narrative
App Engine version {version.name} is publicly reachable at its appspot.com URL PublicEndpoint with no ingress restriction.
Raw rule rules/derived/gcp/appengine.yaml
id: gcp-appengine-exposed-internet
emits: ExposedToInternet
description: A serving App Engine version is reachable at its appspot.com URL (modeled as a PublicEndpoint
node) unless ingress-restricted.
match_record:
resource_type: google.appengine.Version
field: servingStatus
where:
- version.servingStatus == SERVING
- no restrictive appengine.firewall ingress rule denies public source ranges AND app not IAP-gated
- source is the appspot.com URL PublicEndpoint node for the service/version (schema ExposedToInternet.source
includes PublicEndpoint), NOT the Version/ApplicationPlatform node
emit:
target_type: AnonymousIdentity
source: <appspot.com URL PublicEndpoint>
target: <AnonymousIdentity>
conditions:
- network_reachability
state_logic: 'ACTIVE if default ingress firewall (allow *) and no IAP; else BLOCKED if a deny-all ingress
rule or IAP restricts access.
'
false_positive_note: Ingress firewall deny-all rules or IAP protection remove public reachability ->
downgrade to CONDITIONAL or emit BLOCKED with denied_by=<ingress rule/IAP>.
narrative: App Engine version {version.name} is publicly reachable at its appspot.com URL PublicEndpoint
with no ingress restriction.