rage.fail

gcp-gcs-has-policy

explicit gcp emits HasPolicy

match (record)

{ "api": "storage.buckets.getIamPolicy", "field": "bindings", "resource_type": "google.storage.Bucket" }

emit

source type	`Storage`
target type	`Policy`
source	`<bucket node>`
target	`<bucket ResourcePolicy node>`

Narrative

{bucket.name} has an IAM allow policy governing access to its objects.

Raw rule rules/explicit/gcp-gcs.yaml

id: gcp-gcs-has-policy
emits: HasPolicy
applies_to:
- gcp
match_record:
  api: storage.buckets.getIamPolicy
  resource_type: google.storage.Bucket
  field: bindings
emit:
  source_type: Storage
  target_type: Policy
  source: <bucket node>
  target: <bucket ResourcePolicy node>
  api_source: storage.buckets.getIamPolicy
  evidence_field: iamPolicy.bindings
  narrative: '{bucket.name} has an IAM allow policy governing access to its objects.'