rage.fail

gcp-ar-org-wide-download

explicit gcp emits ExposedToTenant

match (record)

{ "field": "iamPolicy.bindings", "resource_type": "google.artifactregistry.Repository" }

where

binding member is allAuthenticatedUsers binding role or permissions include artifactregistry.repositories.downloadArtifacts

emit

source type	`ArtifactRepository`
target type	`Organization`
source	`<Artifact Registry repository node>`
target	`<GCP Organization>`

Narrative

Repository {repo.name} grants download access to allAuthenticatedUsers (any authenticated Google identity, including external accounts); any Google-authenticated principal can pull from this repository.

Raw rule rules/explicit/gcp-artifactregistry.yaml

id: gcp-ar-org-wide-download
emits: ExposedToTenant
applies_to:
- gcp
match_record:
  resource_type: google.artifactregistry.Repository
  field: iamPolicy.bindings
where:
- binding member is allAuthenticatedUsers
- binding role or permissions include artifactregistry.repositories.downloadArtifacts
emit:
  source_type: ArtifactRepository
  target_type: Organization
  source: <Artifact Registry repository node>
  target: <GCP Organization>
  api_source: artifactregistry.projects.locations.repositories.getIamPolicy
  evidence_field: iamPolicy.bindings[].members (allAuthenticatedUsers)
  narrative: Repository {repo.name} grants download access to allAuthenticatedUsers (any authenticated
    Google identity, including external accounts); any Google-authenticated principal can pull from this
    repository.