gcp-filestore-nfs-data-access

id: gcp-filestore-nfs-data-access
emits:
- CanReadData
- CanWriteData
description: "A VM whose source IP falls within a Filestore NFS export range can mount the share and read\
  \ (and write, if READ_WRITE) all files without any IAM check \u2014 access is purely IP-address gated.\
  \ CanWriteData is emitted when accessMode is READ_WRITE; CanReadData for both READ_WRITE and READ_ONLY."
match:
- - instance: null
  - HasPolicy
  - export_policy: null
where:
- node_type(?instance) == FileStorage
- ?export_policy is the NFS export-options configuration of ?instance
- 'exists ?vm: node_type(?vm) in [VirtualMachine, Container, ContainerTask, KubernetesWorkload]'
- ?vm.ip is within at least one ipRange in ?export_policy.nfsExportOptions
- the matching export rule has accessMode == READ_WRITE or READ_ONLY
- ?vm is in the same VPC (networks[].network) as ?instance, or in a peered/Shared-VPC network with L3
  reachability
emit:
- edge_type: CanReadData
  source_type: Compute
  target_type: FileStorage
  source: ?vm
  target: ?instance
  permissions: []
  conditions:
  - network_reachability
  state_logic: "ACTIVE when: (a) the VM's source IP is confirmed within an exported NFS range AND (b)\
    \ TCP/UDP 2049 is not blocked by VPC firewall rules between the VM and the Filestore instance IP.\
    \ CONDITIONAL(network_reachability) when VPC topology or CIDR overlap is not fully resolved (e.g.\
    \ Shared VPC peering unconfirmed, alias-IP ranges not collected). BLOCKED if the VPC firewall explicitly\
    \ blocks TCP/UDP 2049 from ?vm to the instance IP, or if the nfsExportOptions list is empty. NOTE:\
    \ Do NOT apply key_permission gating. CMEK decrypt on Filestore is performed by the Filestore service\
    \ agent \u2014 the mounting VM needs no KMS permission. Never emit ExposedToInternet: Filestore has\
    \ no public-IP surface."
  confidence: 0.9 when CIDR overlap is confirmed; 0.5 when VPC topology unresolved
  derived_from:
  - gcp-filestore-explicit-nfs-export-options
  false_positive_note: "CRITICAL: network_reachability is the sole gate \u2014 there is no IAM check at\
    \ NFS mount time. Confirm the VM's primary NIC IP (or alias IP) overlaps the exported CIDR. Shared\
    \ VPC: a service-project VM reaches a host-VPC Filestore instance only if the instance's network is\
    \ the host VPC AND the VM's IP falls in an exported range. Basic-tier instances do not support overlapping\
    \ IP rules \u2014 use the first-matched (most specific) rule only. Default export (READ_WRITE, NO_ROOT_SQUASH,\
    \ all RFC-1918 VPC IPs) means most same-VPC VMs already qualify; emit as ACTIVE when the default export\
    \ is confirmed and the VM's IP is RFC-1918 in the same VPC. Never emit ExposedToInternet. With READ_WRITE\
    \ access and NO_ROOT_SQUASH (the documented default for same-VPC mounting), client root maps to share\
    \ root: attacker can plant setuid binaries, overwrite configs, or corrupt data."
  narrative: '{vm.name} (IP {vm.ip}) is within the NFS export range of {instance.name} and can mount the
    share over NFS, reading all files without any IAM check.'
- edge_type: CanWriteData
  source_type: Compute
  target_type: FileStorage
  source: ?vm
  target: ?instance
  permissions: []
  conditions:
  - network_reachability
  match_condition: ?export_policy.nfsExportOptions[].accessMode == READ_WRITE
  state_logic: 'ACTIVE when: (a) the VM''s source IP is confirmed within an exported NFS range with READ_WRITE
    access mode AND (b) TCP/UDP 2049 is not blocked. CONDITIONAL(network_reachability) when CIDR overlap
    is unconfirmed. BLOCKED if the VPC firewall blocks NFS or all export rules are READ_ONLY. NO_ROOT_SQUASH
    (the default) means client root becomes share root: attackers can plant setuid binaries, overwrite
    application configs, or corrupt data.'
  confidence: 0.9 when READ_WRITE CIDR overlap is confirmed; 0.5 when topology unresolved
  derived_from:
  - gcp-filestore-explicit-nfs-export-options
  narrative: '{vm.name} (IP {vm.ip}) can mount {instance.name} with READ_WRITE access, allowing it to
    modify or delete all files on the share.'