gcp-gcs-public-access-prevention
explicit
gcp
emits
match (record)
{
"api": "storage.buckets.get",
"field": "iamConfiguration.publicAccessPrevention",
"resource_type": "google.storage.Bucket"
}
emit
Raw rule rules/explicit/gcp-gcs.yaml
id: gcp-gcs-public-access-prevention
emits: null
kind: evidence
applies_to:
- gcp
match_record:
api: storage.buckets.get
resource_type: google.storage.Bucket
field: iamConfiguration.publicAccessPrevention
record:
on_node: <bucket / ObjectStorage node>
field: public_access_prevention
value: <enforced | inherited>
api_source: storage.buckets.get
evidence_field: iamConfiguration.publicAccessPrevention
note: When 'enforced' (either at bucket level or via org policy constraints/gcp.storagePublicAccessPrevention),
allUsers bindings are rejected and existing ones are removed -> gcp-gcs-exposed-to-internet should
be BLOCKED when this field is 'enforced'. When 'inherited', the project/folder/org org policy determines
the effective prevention; check the org policy hierarchy for constraints/gcp.storagePublicAccessPrevention.