gcp-firestore-explicit-cmek-ref
explicit
gcp
emits
match (record)
{
"api": "firestore.projects.databases.get",
"field": "cmekConfig.kmsKeyName",
"resource_type": "google.firestore.Database"
}
where
cmekConfig.kmsKeyName is set (database is CMEK-encrypted)
emit
Raw rule rules/explicit/gcp-firestore.yaml
id: gcp-firestore-explicit-cmek-ref
emits: null
kind: evidence
applies_to:
- gcp
match_record:
api: firestore.projects.databases.get
resource_type: google.firestore.Database
field: cmekConfig.kmsKeyName
where:
- cmekConfig.kmsKeyName is set (database is CMEK-encrypted)
record:
on_node: <Firestore Database node>
field: cmek_key
value: <Cloud KMS CryptoKey referenced by cmekConfig.kmsKeyName>
api_source: firestore.projects.databases.get
evidence_field: cmekConfig.kmsKeyName
note: 'Evidence for gcp-firestore-read-data-cmek: the key_permission gate is on the Firestore Service
Agent (service-PROJECT_NUMBER@gcp-sa-firestore.iam.gserviceaccount.com), NOT the accessing principal.
No graph edge is emitted from the Database to the key; the reference is recorded as evidence on the
Database node.'