gcp-bigquery-explicit-exposed-to-internet

id: gcp-bigquery-explicit-exposed-to-internet
emits: ExposedToInternet
description: "A dataset ACL entry for allUsers makes it queryable by unauthenticated public principals\
  \ \u2014 internet-accessible data."
match_record:
  resource_type: google.bigquery.Dataset
  field: access[].specialGroup == 'allUsers'
emit:
  source_type: Data
  target_type: AnonymousIdentity
  source: <BigQuery Dataset node>
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - resource_policy
  state_logic: ACTIVE when access[].specialGroup == 'allUsers' is present; BLOCKED when a VPC-SC perimeter
    that blocks allUsers queries is confirmed.
  false_positive_note: "allUsers grants unauthenticated access \u2014 any internet user can query the\
    \ dataset without any Google credentials. This is the strongest form of exposure. Only emit for datasets\
    \ whose access[] contains specialGroup==allUsers; do NOT emit for access[].specialGroup==allAuthenticatedUsers\
    \ (that is ExposedToTenant, not internet). BigQuery public datasets (bigquery-public-data) are intentionally\
    \ public \u2014 analyst should mark them not-a-finding unless the source project is a customer project\
    \ unexpectedly granting allUsers."
  narrative: Dataset {dataset.name} is publicly accessible via a BigQuery allUsers ACL entry; any unauthenticated
    internet user can query its tables.
  derived_from:
  - google.bigquery.Dataset.access[].specialGroup == 'allUsers'
  api_source: bigquery.datasets.get (access[] array)
  evidence_field: access[].specialGroup == 'allUsers'