gcp-firestore-iam-allusers-public
An IAM binding on a Firestore database naming 'allUsers' as a principal allows unauthenticated access to the database via the Cloud IAM / Admin SDK surface.
match (record)
{
"api": "firestore.projects.databases.getIamPolicy",
"field": "iamPolicy.bindings[].members",
"resource_type": "google.firestore.Database"
}
where
an IAM binding member is 'allUsers' (literal string or principal:allUsers)
emit
| source type | Data |
|---|---|
| target type | AnonymousIdentity |
| source | <Firestore Database / NoSQLDatabase node> |
| target | <AnonymousIdentity> |
| conditions | resource_policy |
| state logic | ACTIVE when the IAM binding explicitly names 'allUsers' and the binding grants a role that includes datastore read/write permissions (e.g. roles/datastore.viewer, roles/datastore.editor, roles/datastore.owner). The Firestore API endpoint (firestore.googleapis.com) is publicly reachable; any internet user with the GCP project ID can call Admin SDK methods. VPC-SC perimeter including Firestore may block external callers -> BLOCKED(resource_policy). |
Narrative
Firestore database {database.name} has an IAM binding granting access to 'allUsers', meaning any unauthenticated internet user can access it via the Admin SDK. This is a critical misconfiguration; any internet client with the project ID and database name can read/write all documents (if the role includes datastore.entities.*).
Raw rule rules/explicit/gcp-firestore.yaml
id: gcp-firestore-iam-allusers-public
emits: ExposedToInternet
description: An IAM binding on a Firestore database naming 'allUsers' as a principal allows unauthenticated
access to the database via the Cloud IAM / Admin SDK surface.
match_record:
api: firestore.projects.databases.getIamPolicy
resource_type: google.firestore.Database
field: iamPolicy.bindings[].members
where:
- an IAM binding member is 'allUsers' (literal string or principal:allUsers)
emit:
source_type: Data
target_type: AnonymousIdentity
source: <Firestore Database / NoSQLDatabase node>
target: <AnonymousIdentity>
permissions: []
conditions:
- resource_policy
state_logic: ACTIVE when the IAM binding explicitly names 'allUsers' and the binding grants a role that
includes datastore read/write permissions (e.g. roles/datastore.viewer, roles/datastore.editor, roles/datastore.owner).
The Firestore API endpoint (firestore.googleapis.com) is publicly reachable; any internet user with
the GCP project ID can call Admin SDK methods. VPC-SC perimeter including Firestore may block external
callers -> BLOCKED(resource_policy).
confidence: '0.95'
derived_from:
- google.firestore.Database iamPolicy.bindings[] naming allUsers
false_positive_note: This is RARE for Firestore and EXTREMELY unusual. allUsers binding on a Firestore
database grants unauthenticated data access to any internet user. Do NOT confuse with Firebase Security
Rules (which govern the Firebase client SDK, not IAM). IAM allUsers bindings on Firestore databases
are almost always misconfigurations. VPC-SC can mitigate if the perimeter includes firestore.googleapis.com
and the caller is outside the perimeter -> emit CONDITIONAL(resource_policy) if VPC-SC may apply.
Org policy constraints denying IAM mutations may prevent this binding from being added.
narrative: Firestore database {database.name} has an IAM binding granting access to 'allUsers', meaning
any unauthenticated internet user can access it via the Admin SDK. This is a critical misconfiguration;
any internet client with the project ID and database name can read/write all documents (if the role
includes datastore.entities.*).