rage.fail

gcp-firestore-explicit-has-policy

explicit gcp emits HasPolicy

match (record)

{ "api": "firestore.projects.databases.getIamPolicy", "field": "bindings", "resource_type": "google.firestore.Database" }

where

iamPolicy.bindings is present (non-empty)

emit

source type	`Data`
target type	`Policy`
source	`<Firestore Database node>`
target	`<database ResourcePolicy node>`

Narrative

{database.name} has an IAM allow policy governing who may access its documents.

Raw rule rules/explicit/gcp-firestore.yaml

id: gcp-firestore-explicit-has-policy
emits: HasPolicy
applies_to:
- gcp
match_record:
  api: firestore.projects.databases.getIamPolicy
  resource_type: google.firestore.Database
  field: bindings
where:
- iamPolicy.bindings is present (non-empty)
emit:
  source_type: Data
  target_type: Policy
  source: <Firestore Database node>
  target: <database ResourcePolicy node>
  api_source: firestore.projects.databases.getIamPolicy
  evidence_field: iamPolicy.bindings
  narrative: '{database.name} has an IAM allow policy governing who may access its documents.'