gcp-firestore-iam-allauthenticated-public
An IAM binding on a Firestore database naming 'allAuthenticatedUsers' allows access to any GCP-authenticated user, exposing data tenant-wide.
match (record)
{
"api": "firestore.projects.databases.getIamPolicy",
"field": "iamPolicy.bindings[].members",
"resource_type": "google.firestore.Database"
}
where
an IAM binding member is 'allAuthenticatedUsers' (literal string or principal:allAuthenticatedUsers)
emit
| source type | Data |
|---|---|
| target type | Organization |
| source | <Firestore Database / NoSQLDatabase node> |
| target | <GCP Organization node> |
| conditions | resource_policy |
| state logic | ACTIVE when the IAM binding explicitly names 'allAuthenticatedUsers' and grants a role including datastore read/write permissions. Any GCP-authenticated user (including users in other projects/organizations with a Google account) can access the database. VPC-SC perimeter may block external callers -> CONDITIONAL. |
Narrative
Firestore database {database.name} has an IAM binding granting access to 'allAuthenticatedUsers', meaning any GCP-authenticated user can access it. This exposes the database to a broad set of internet principals outside the organization.
Raw rule rules/explicit/gcp-firestore.yaml
id: gcp-firestore-iam-allauthenticated-public
emits: ExposedToTenant
description: An IAM binding on a Firestore database naming 'allAuthenticatedUsers' allows access to any
GCP-authenticated user, exposing data tenant-wide.
match_record:
api: firestore.projects.databases.getIamPolicy
resource_type: google.firestore.Database
field: iamPolicy.bindings[].members
where:
- an IAM binding member is 'allAuthenticatedUsers' (literal string or principal:allAuthenticatedUsers)
emit:
source_type: Data
target_type: Organization
source: <Firestore Database / NoSQLDatabase node>
target: <GCP Organization node>
permissions: []
conditions:
- resource_policy
state_logic: ACTIVE when the IAM binding explicitly names 'allAuthenticatedUsers' and grants a role
including datastore read/write permissions. Any GCP-authenticated user (including users in other projects/organizations
with a Google account) can access the database. VPC-SC perimeter may block external callers -> CONDITIONAL.
confidence: '0.92'
derived_from:
- google.firestore.Database iamPolicy.bindings[] naming allAuthenticatedUsers
false_positive_note: "allAuthenticatedUsers is broader than organization scope \u2014 it includes any\
\ user with a Google account (Gmail, corporate Google Workspace, external federation). Intended for\
\ truly public services, not organizational data. VPC-SC and org policy constraints may mitigate.\
\ This is distinct from Firebase Security Rules (which can also expose via 'allUsers' / 'allAuthenticatedUsers'\
\ but only via the client SDK, not Admin SDK)."
narrative: Firestore database {database.name} has an IAM binding granting access to 'allAuthenticatedUsers',
meaning any GCP-authenticated user can access it. This exposes the database to a broad set of internet
principals outside the organization.