gcp-bigtable-read-data
bigtable.tables.readRows constitutes effective data-plane read access: the caller can stream any row from any column family in the table via the ReadRows API. For CMEK-encrypted clusters the capability is CONDITIONAL(key_permission) on the Bigtable service agent's Cloud KMS grant, not on the caller's own KMS permissions.
match (effective permission)
{
"action": "bigtable.tables.readRows",
"resource_type": "google.bigtable.admin.v2.Table"
}
where
instance.state EQUALS READY
cluster.encryptionConfig.kmsKeyName EQUALS NULL
emit
| source type | Identity |
|---|---|
| target type | NoSQLDatabase |
| source | <principal> |
| target | <Bigtable Table / NoSQLDatabase node> |
| permissions | bigtable.tables.readRows |
| conditions | iam_permission resource_policy |
| state logic | ACTIVE when bigtable.tables.readRows is confirmed ACTIVE effective permission on the table (or enclosing instance or project scope) AND the instance state is READY AND no VPC-SC perimeter blocks bigtable.googleapis.com for the caller's network context; CONDITIONAL(resource_policy) when the effective-permission evaluator can only confirm project-scope binding that may be capped by an IAM Conditions expression or deny policy on the table; BLOCKED when a VPC-SC perimeter enforces and the caller is outside the perimeter, or when a deny policy explicitly denies readRows. |
Narrative
{principal.name} holds bigtable.tables.readRows on table {table.name} in instance {instance.name}; it can stream any row via the ReadRows API, reading all data stored in the table including any application credentials or sensitive values.
Raw rule rules/derived/gcp/bigtable.yaml
id: gcp-bigtable-read-data
emits: CanReadData
description: 'bigtable.tables.readRows constitutes effective data-plane read access: the caller can stream
any row from any column family in the table via the ReadRows API. For CMEK-encrypted clusters the capability
is CONDITIONAL(key_permission) on the Bigtable service agent''s Cloud KMS grant, not on the caller''s
own KMS permissions.'
match_effective_permission:
action: bigtable.tables.readRows
resource_type: google.bigtable.admin.v2.Table
where:
- instance.state EQUALS READY
- cluster.encryptionConfig.kmsKeyName EQUALS NULL
emit:
source_type: Identity
target_type: NoSQLDatabase
source: <principal>
target: <Bigtable Table / NoSQLDatabase node>
permissions:
- bigtable.tables.readRows
conditions:
- iam_permission
- resource_policy
state_logic: ACTIVE when bigtable.tables.readRows is confirmed ACTIVE effective permission on the table
(or enclosing instance or project scope) AND the instance state is READY AND no VPC-SC perimeter blocks
bigtable.googleapis.com for the caller's network context; CONDITIONAL(resource_policy) when the effective-permission
evaluator can only confirm project-scope binding that may be capped by an IAM Conditions expression
or deny policy on the table; BLOCKED when a VPC-SC perimeter enforces and the caller is outside the
perimeter, or when a deny policy explicitly denies readRows.
confidence: min(contributing_confidences) * 0.97
derived_from:
- bigtable.tables.readRows effective permission on Table
false_positive_note: "bigtable.tables.readRows is the exact IAM permission name for ReadRows / SampleRowKeys\
\ calls. Do not conflate with bigtable.authorizedViews.readRows (table subset only) or bigtable.tables.mutateRows\
\ (write-only). Bigtable has no secondary DB-credential layer \u2014 IAM permission is sufficient\
\ for data access. Bigtable IAM inheritance runs project -> instance -> table -> authorized view;\
\ a project-level roles/bigtable.reader grants readRows on ALL tables in all instances in the project.\
\ Honor IAM Conditions expressions that may scope the binding to specific instances or table name\
\ prefixes. A human user must hold at least one project-level Bigtable role before table-level grants\
\ take effect (service accounts are exempt from this requirement, which is enforcement-UI only, not\
\ API-level). VPC-SC perimeters that include bigtable.googleapis.com in the restricted services set\
\ block callers outside the perimeter -> BLOCKED(resource_policy)."
narrative: '{principal.name} holds bigtable.tables.readRows on table {table.name} in instance {instance.name};
it can stream any row via the ReadRows API, reading all data stored in the table including any application
credentials or sensitive values.'