gcp-firestore-read-data

id: gcp-firestore-read-data
emits: CanReadData
description: datastore.entities.get constitutes effective data-plane read access to Firestore/Datastore
  documents.
match_effective_permission:
  action: datastore.entities.get
  resource_type: google.firestore.Database
where:
- "database is NOT CMEK-encrypted (cmekConfig.kmsKeyName unset) \u2014 for CMEK see gcp-firestore-read-data-cmek"
emit:
  source_type: Identity
  target_type: Data
  source: <principal>
  target: <Firestore Database / NoSQLDatabase node>
  permissions:
  - datastore.entities.get
  conditions:
  - iam_permission
  - resource_policy
  state_logic: ACTIVE when datastore.entities.get is confirmed effective at the project or database scope
    (Firestore uses project-level IAM; multi-database configurations also support database-level IAM)
    and no VPC-SC perimeter blocks the Firestore API for the caller's context; CONDITIONAL(resource_policy)
    when the IAM scope is uncertain or namespace-level restrictions exist; BLOCKED when a VPC-SC perimeter,
    IAM deny policy, or org policy explicitly denies datastore.entities.get for this caller.
  confidence: min(contributing_confidences) * 0.96
  derived_from:
  - datastore.entities.get effective permission on Firestore Database
  false_positive_note: "datastore.entities.list (without get) provides only key metadata (document IDs,\
    \ collection names) \u2014 NOT document content. Do NOT emit CanReadData from entities.list alone.\
    \ Firestore has two modes \u2014 native mode and Datastore mode \u2014 both use `datastore.*` IAM\
    \ permissions; do not invent `firestore.*` data-plane permissions for IAM callers (those permissions\
    \ do not exist; the correct IAM actions are all in the `datastore.*` namespace as of GA). In multi-database\
    \ Firestore projects, IAM is scoped per database; confirm the effective permission applies to the\
    \ database node being targeted. VPC-SC perimeters that include the Firestore API block callers outside\
    \ the perimeter -> BLOCKED. Firebase Security Rules do NOT govern IAM callers (Admin SDK bypasses\
    \ them)."
  narrative: '{principal.name} holds datastore.entities.get on {database.name} and can read the content
    of any document in the Firestore database. Firestore data commonly contains application secrets, user
    PII, and embedded credentials.'