gcp-gcs-authed-users

id: gcp-gcs-authed-users
emits: ExposedToTenant
description: "A bucket IAM binding granting any read role to allAuthenticatedUsers makes the bucket readable\
  \ by any Google-authenticated user worldwide (not limited to the organization) \u2014 broad tenant-wide\
  \ exposure including external Google accounts."
match_record:
  resource_type: google.storage.Bucket
  field: iamPolicy.bindings[].members (contains 'allAuthenticatedUsers')
where:
- the binding grants a role that includes storage.objects.get
emit:
  source_type: Storage
  target_type: Organization
  source: <GCS Bucket / ObjectStorage node>
  target: <GCP Organization / Tenant node>
  permissions: []
  conditions:
  - resource_policy
  state_logic: ACTIVE when allAuthenticatedUsers binding is present in the effective IAM policy and no
    org policy (iam.allowedPolicyMemberTypes or publicAccessPrevention) blocks it; CONDITIONAL(scp_or_org_policy)
    when org policy restricts allAuthenticatedUsers usage; BLOCKED when org policy explicitly denies it.
  confidence: '0.95'
  derived_from:
  - google.storage.Bucket iamPolicy.bindings (allAuthenticatedUsers)
  false_positive_note: "allAuthenticatedUsers grants access to any Google-authenticated account \u2014\
    \ including personal Gmail accounts, Google accounts in other organizations, and any account with\
    \ a valid Google identity. This is BROADER than an org-level domain grant and is a serious misconfiguration\
    \ for any bucket holding non-public data. The target_type Organization signals GCP-org scope, but\
    \ the actual exposure extends GLOBALLY to any Google-authenticated user worldwide. Do NOT model as\
    \ ExposedToInternet (requires no login); model as ExposedToTenant. Org policy iam.allowedPolicyMemberTypes\
    \ can restrict allAuthenticatedUsers usage at the org/folder/project level -> BLOCKED(scp_or_org_policy).\
    \ Analyst should note that this exposure is NOT limited to the GCP Organization boundary \u2014 it\
    \ is open to any Google account."
  narrative: Bucket {bucket.name} grants storage.objects.get to allAuthenticatedUsers; any Google-authenticated
    account worldwide (including accounts outside the GCP Organization, personal Gmail, foreign projects)
    can read its objects.