gcp-bigtable-read-authorized-view
bigtable.authorizedViews.readRows grants read access to a scoped subset of a table (row key prefix / column qualifier filtering). The caller can only read the rows/columns defined by the authorized view; access to the parent table is NOT granted. CanReadData is scoped to the AuthorizedView node.
match (effective permission)
{
"action": "bigtable.authorizedViews.readRows",
"resource_type": "google.bigtable.admin.v2.AuthorizedView"
}
where
instance.state EQUALS READY
emit
| source type | Identity |
|---|---|
| target type | NoSQLDatabase |
| source | <principal> |
| target | <Authorized View / NoSQLDatabase node> |
| permissions | bigtable.authorizedViews.readRows |
| conditions | iam_permission resource_policy |
| state logic | ACTIVE when bigtable.authorizedViews.readRows is confirmed ACTIVE effective permission on the authorized view AND the instance state is READY AND no VPC-SC perimeter blocks bigtable.googleapis.com for the caller's context; CONDITIONAL(resource_policy) when the effective-permission evaluator can only confirm project-scope binding that may be capped by IAM Conditions; BLOCKED when a VPC-SC perimeter enforces or a deny policy denies the permission. |
Narrative
{principal.name} holds bigtable.authorizedViews.readRows on authorized view {view.name} of table {table.name}; it can stream rows from the view's row-key prefix and column-qualifier scope only, not the full table.
Raw rule rules/derived/gcp/bigtable.yaml
id: gcp-bigtable-read-authorized-view
emits: CanReadData
description: bigtable.authorizedViews.readRows grants read access to a scoped subset of a table (row key
prefix / column qualifier filtering). The caller can only read the rows/columns defined by the authorized
view; access to the parent table is NOT granted. CanReadData is scoped to the AuthorizedView node.
match_effective_permission:
action: bigtable.authorizedViews.readRows
resource_type: google.bigtable.admin.v2.AuthorizedView
where:
- instance.state EQUALS READY
emit:
source_type: Identity
target_type: NoSQLDatabase
source: <principal>
target: <Authorized View / NoSQLDatabase node>
permissions:
- bigtable.authorizedViews.readRows
conditions:
- iam_permission
- resource_policy
state_logic: ACTIVE when bigtable.authorizedViews.readRows is confirmed ACTIVE effective permission
on the authorized view AND the instance state is READY AND no VPC-SC perimeter blocks bigtable.googleapis.com
for the caller's context; CONDITIONAL(resource_policy) when the effective-permission evaluator can
only confirm project-scope binding that may be capped by IAM Conditions; BLOCKED when a VPC-SC perimeter
enforces or a deny policy denies the permission.
confidence: min(contributing_confidences) * 0.96
derived_from:
- bigtable.authorizedViews.readRows effective permission on AuthorizedView
false_positive_note: 'IMPORTANT: A principal with bigtable.authorizedViews.readRows on a VIEW does NOT
have access to the parent table. Authorized views implement row/column scoping at the IAM level; the
view''s read permission is scoped to its subset. Do NOT chain this view''s CanReadData to the parent
table''s CanReadData without an explicit Contains edge and separate derivation. View read and table
read are separate, non-escalating capabilities. An attacker must hold bigtable.tables.readRows on
the table itself to read beyond the view''s scope. Authorization boundaries are strictly enforced
by the Bigtable API.'
narrative: '{principal.name} holds bigtable.authorizedViews.readRows on authorized view {view.name}
of table {table.name}; it can stream rows from the view''s row-key prefix and column-qualifier scope
only, not the full table.'