rage.fail

gcp-ar-public-upload

explicit gcp emits ExposedToInternet

match (record)

{ "field": "iamPolicy.bindings", "resource_type": "google.artifactregistry.Repository" }

where

binding member is allUsers binding role or permissions include artifactregistry.repositories.uploadArtifacts

emit

source type	`ArtifactRepository`
target type	`AnonymousIdentity`
source	`<Artifact Registry repository node>`
target	`<AnonymousIdentity>`

Narrative

Repository {repo.name} grants uploadArtifacts access to allUsers (public internet); any unauthenticated attacker on the public internet can push malicious container images or packages into this repository. This is a critical supply-chain injection vulnerability - every workload consuming from {repo.name} is at risk.

Raw rule rules/explicit/gcp-artifactregistry.yaml

id: gcp-ar-public-upload
emits: ExposedToInternet
applies_to:
- gcp
match_record:
  resource_type: google.artifactregistry.Repository
  field: iamPolicy.bindings
where:
- binding member is allUsers
- binding role or permissions include artifactregistry.repositories.uploadArtifacts
emit:
  source_type: ArtifactRepository
  target_type: AnonymousIdentity
  source: <Artifact Registry repository node>
  target: <AnonymousIdentity>
  api_source: artifactregistry.projects.locations.repositories.getIamPolicy
  evidence_field: iamPolicy.bindings[].members (allUsers)
  narrative: "Repository {repo.name} grants uploadArtifacts access to allUsers (public internet); any\
    \ unauthenticated attacker on the public internet can push malicious container images or packages\
    \ into this repository. This is a critical supply-chain injection vulnerability \u2014 every workload\
    \ consuming from {repo.name} is at risk."