gcp-gcs-cmek-ref
explicit
gcp
emits
match (record)
{
"api": "storage.buckets.get",
"field": "encryption.defaultKmsKeyName",
"resource_type": "google.storage.Bucket"
}
where
encryption.defaultKmsKeyName is set (bucket has a CMEK default key)
emit
Raw rule rules/explicit/gcp-gcs.yaml
id: gcp-gcs-cmek-ref
emits: null
kind: evidence
applies_to:
- gcp
match_record:
api: storage.buckets.get
resource_type: google.storage.Bucket
field: encryption.defaultKmsKeyName
where:
- encryption.defaultKmsKeyName is set (bucket has a CMEK default key)
record:
on_node: <bucket / ObjectStorage node>
field: cmek_key
value: <Cloud KMS CryptoKey resource name from defaultKmsKeyName>
api_source: storage.buckets.get
evidence_field: encryption.defaultKmsKeyName
note: 'Evidence for gcp-gcs-read-data-cmek derived rule: the key_permission gate is evaluated against
the Storage service agent (service-PROJECT_NUMBER@gs-project-accounts.iam.gserviceaccount.com), NOT
the accessing principal. The concrete EncryptionKey node and its KMS IAM bindings are collected and
modeled by the gcp:kms service. No graph edge is emitted here; the CMEK key reference is stored as
a property on the Bucket node for use by the key_permission evaluator.'