rage.fail

gcp-ar-public-download

explicit gcp emits ExposedToInternet

match (record)

{ "field": "iamPolicy.bindings", "resource_type": "google.artifactregistry.Repository" }

where

binding member is allUsers binding role or permissions include artifactregistry.repositories.downloadArtifacts

emit

source type	`ArtifactRepository`
target type	`AnonymousIdentity`
source	`<Artifact Registry repository node>`
target	`<AnonymousIdentity>`

Narrative

Repository {repo.name} grants download access to allUsers (public internet); any unauthenticated principal can pull images or packages from this repository.

Raw rule rules/explicit/gcp-artifactregistry.yaml

id: gcp-ar-public-download
emits: ExposedToInternet
applies_to:
- gcp
match_record:
  resource_type: google.artifactregistry.Repository
  field: iamPolicy.bindings
where:
- binding member is allUsers
- binding role or permissions include artifactregistry.repositories.downloadArtifacts
emit:
  source_type: ArtifactRepository
  target_type: AnonymousIdentity
  source: <Artifact Registry repository node>
  target: <AnonymousIdentity>
  api_source: artifactregistry.projects.locations.repositories.getIamPolicy
  evidence_field: iamPolicy.bindings[].members (allUsers)
  narrative: Repository {repo.name} grants download access to allUsers (public internet); any unauthenticated
    principal can pull images or packages from this repository.