rage.fail

gcp-ar-has-policy

explicit gcp emits HasPolicy

match (record)

{ "field": "iamPolicy.bindings", "resource_type": "google.artifactregistry.Repository" }

emit

source type	`ArtifactRepository`
target type	`ResourcePolicy`
source	`<Artifact Registry repository node>`
target	`<ResourcePolicy node for the repository's IAM allow policy>`

Narrative

{repo.name} has an IAM allow policy governing who can push, pull, and administer the repository.

Raw rule rules/explicit/gcp-artifactregistry.yaml

id: gcp-ar-has-policy
emits: HasPolicy
applies_to:
- gcp
match_record:
  resource_type: google.artifactregistry.Repository
  field: iamPolicy.bindings
emit:
  source_type: ArtifactRepository
  target_type: ResourcePolicy
  source: <Artifact Registry repository node>
  target: <ResourcePolicy node for the repository's IAM allow policy>
  api_source: artifactregistry.projects.locations.repositories.getIamPolicy
  evidence_field: iamPolicy.bindings
  narrative: '{repo.name} has an IAM allow policy governing who can push, pull, and administer the repository.'