gcp-bigquery-explicit-exposed-to-tenant

id: gcp-bigquery-explicit-exposed-to-tenant
emits: ExposedToTenant
description: "A dataset ACL entry for allAuthenticatedUsers makes it readable by any Google-authenticated\
  \ user \u2014 org-wide or tenant-wide exposure."
match_record:
  resource_type: google.bigquery.Dataset
  field: access[].specialGroup == 'allAuthenticatedUsers'
emit:
  source_type: Data
  target_type: Organization
  source: <BigQuery Dataset node>
  target: <GCP Organization / Tenant node>
  permissions: []
  conditions:
  - resource_policy
  state_logic: ACTIVE when access[].specialGroup == 'allAuthenticatedUsers' is present and no org policy
    restricts this; CONDITIONAL(scp_or_org_policy) if an org policy disallows allAuthenticatedUsers grants.
  false_positive_note: "allAuthenticatedUsers grants read to any Google-authenticated principal \u2014\
    \ this includes Google accounts outside the organization. It is broader than an org-level grant. Do\
    \ not treat as equivalent to domain-level grants (access[].domain = 'example.com') which restrict\
    \ to a single domain. allAuthenticatedUsers is considered a serious misconfiguration for sensitive\
    \ datasets. Org policy constraints.gcp.restrictCloudRunRegion is unrelated; the relevant org policy\
    \ is iam.allowedPolicyMemberTypes which can restrict allAuthenticatedUsers usage."
  narrative: "Dataset {dataset.name} grants access to allAuthenticatedUsers \u2014 any Google- authenticated\
    \ account (including those outside the organization) can query its tables."
  derived_from:
  - google.bigquery.Dataset.access[].specialGroup == 'allAuthenticatedUsers'
  api_source: bigquery.datasets.get (access[] array)
  evidence_field: access[].specialGroup == 'allAuthenticatedUsers'