gcp-ar-download-is-read
artifactregistry.repositories.downloadArtifacts grants pull/read access to images and packages in the repo - required for consumers and useful for recon.
match (effective permission)
{
"action": "artifactregistry.repositories.downloadArtifacts",
"resource_type": "google.artifactregistry.Repository"
}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <Artifact Registry repository in scope> |
| permissions | artifactregistry.repositories.downloadArtifacts |
| state logic | ACTIVE when the permission is effective. BLOCKED if VPC-SC perimeter enforced and principal is outside it. Low attack value by itself; primarily useful when chained with ContainsSecret on generic-artifact repos or as a prerequisite for dependency recon. |
Narrative
{principal.name} can pull artifacts from repository {repo.name} (artifactregistry.repositories.downloadArtifacts) - read access to all images and packages in the repo.
Raw rule rules/derived/gcp/artifactregistry.yaml
id: gcp-ar-download-is-read
emits: CanRead
description: "artifactregistry.repositories.downloadArtifacts grants pull/read access to images and packages\
\ in the repo \u2014 required for consumers and useful for recon."
match_effective_permission:
action: artifactregistry.repositories.downloadArtifacts
resource_type: google.artifactregistry.Repository
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <Artifact Registry repository in scope>
permissions:
- artifactregistry.repositories.downloadArtifacts
conditions: []
state_logic: ACTIVE when the permission is effective. BLOCKED if VPC-SC perimeter enforced and principal
is outside it. Low attack value by itself; primarily useful when chained with ContainsSecret on generic-artifact
repos or as a prerequisite for dependency recon.
confidence: 0.8
derived_from:
- 'effective permission: artifactregistry.repositories.downloadArtifacts on <repo>'
false_positive_note: "Pull access alone is not an escalation \u2014 do not include this edge in privilege-escalation\
\ path queries without a ContainsSecret or similar annotation on the repo. Its primary path-finding\
\ value is for data-access and recon queries, and as evidence that a workload is a legitimate consumer\
\ (feeds ContainsResourceReference edge collection). The target_type is resolved at emit time from\
\ the repository's generic_type (both ContainerRegistry and ArtifactRepository nodes are valid pull\
\ targets)."
narrative: "{principal.name} can pull artifacts from repository {repo.name} (artifactregistry.repositories.downloadArtifacts)\
\ \u2014 read access to all images and packages in the repo."