gcp-firewall-inbound-open

id: gcp-firewall-inbound-open
emits: CanReachPort
description: "Ingress ALLOW from 0.0.0.0/0 on a port means any internet source can reach that port on\
  \ matched VMs \u2014 a per-firewall-rule network FACT."
applies_to:
- gcp
match:
- - firewall_rule: null
  - LocatedIn
  - network: null
where:
- ?firewall_rule.direction == INGRESS
- ?firewall_rule.action == ALLOW
- 0.0.0.0/0 or ::/0 in ?firewall_rule.sourceRanges
- ?firewall_rule.allowed[].ports is non-empty (protocol + ports specified)
- ?vm is a VirtualMachine in ?network matching ?firewall_rule.targetTags OR ?firewall_rule.targetServiceAccounts
  (or rule has no target restriction)
- no lower-priority-number DENY rule covers the same (target, protocol+port, 0.0.0.0/0) tuple
emit:
  source_type: Network
  target_type: Compute
  source: <synthetic PublicEndpoint / VirtualNetwork node representing the internet ingress>
  target: <VirtualMachine node matching rule target scope>
  permissions: []
  conditions:
  - network_reachability
  state_logic: ACTIVE when the VM has a confirmed external IP and no higher-priority DENY shadows this
    ALLOW for the (target, port, 0.0.0.0/0) tuple. CONDITIONAL(network_reachability) when the VM's external
    IP cannot be confirmed at collection time or when the VM has no external IP but may be reachable via
    a public load balancer. BLOCKED when a lower-priority-number DENY covers the same tuple.
  false_positive_note: "Priority evaluation is mandatory: a DENY at priority number lower than this ALLOW\
    \ (e.g. DENY at 900, ALLOW at 1000) defeats the ALLOW for those (target, port, source) combinations.\
    \ Do not emit when shadowed. Target-scope: the VM must carry the targetTag (if set) or run as the\
    \ targetServiceAccount (if set). VMs that do not match the target are not affected. A VM with no external\
    \ IP is not internet-reachable despite the rule \u2014 downgrade to CONDITIONAL(network_reachability)\
    \ for those."
  narrative: Firewall rule {firewall_rule.name} allows ingress from 0.0.0.0/0 on {protocol}/{port}; any
    internet source can reach this port on {vm.name}, subject to the VM having an accessible external
    IP address.
  derived_from:
  - "<LocatedIn(firewall_rule \u2192 network) edge_id>"
  - <VM-tag-match evidence>
  evidence:
    narrative_template: Firewall rule {firewall_rule.name} in VPC {network.name} has direction=INGRESS,
      action=ALLOW, sourceRanges=[0.0.0.0/0], protocols={protocols}, ports={ports}, and targets VM {vm.name}
      (via tag {tag} or SA {sa}). No higher-priority DENY overrides this allow for the matched (target,
      port, source) tuple.