rage.fail

gcp-certmanager-ca-pool-has-policy

explicit gcp emits HasPolicy

match (record)

{ "field": "iamPolicy.bindings", "resource_type": "google.privateca.CaPool" }

emit

source type	`*`
target type	`Policy`
source	`<CA pool node (SigningKey)>`
target	`<CA pool ResourcePolicy node>`

Narrative

{capool.name} has an IAM allow policy governing who may issue certificates and manage the pool.

Raw rule rules/explicit/gcp-certmanager.yaml

id: gcp-certmanager-ca-pool-has-policy
emits: HasPolicy
applies_to:
- gcp
match_record:
  resource_type: google.privateca.CaPool
  field: iamPolicy.bindings
emit:
  source_type: '*'
  target_type: Policy
  source: <CA pool node (SigningKey)>
  target: <CA pool ResourcePolicy node>
  api_source: privateca.projects.locations.caPools.getIamPolicy
  evidence_field: iamPolicy.bindings
  narrative: '{capool.name} has an IAM allow policy governing who may issue certificates and manage the
    pool.'