gcp-gcs-public-allUsers

id: gcp-gcs-public-allUsers
emits: ExposedToInternet
description: A bucket IAM binding granting any read role to allUsers, or a publicRead/publicReadWrite
  predefined ACL (when UBLA is disabled), makes the bucket's objects accessible to unauthenticated internet
  principals.
match_record:
  resource_type: google.storage.Bucket
  field: iamPolicy.bindings[].members (contains 'allUsers') OR acl[].entity == 'allUsers' OR defaultObjectAcl[].entity
    == 'allUsers'
where:
- the binding or ACL entry grants a role that includes storage.objects.get (e.g. roles/storage.objectViewer,
  roles/storage.legacyObjectReader, roles/storage.legacyBucketReader)
- OR predefined ACL is publicRead / publicReadWrite (when UBLA is disabled)
emit:
  source_type: Storage
  target_type: AnonymousIdentity
  source: <GCS Bucket / ObjectStorage node>
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - resource_policy
  state_logic: ACTIVE when allUsers binding or publicRead ACL is present in the effective IAM policy or
    ACL and no org policy (constraints/gcp.storagePublicAccessPrevention or publicAccessPrevention ==
    enforced at bucket level) blocks it; BLOCKED when org policy or bucket-level public access prevention
    is enforced AND confirmed. When UBLA is enabled, the IAM layer is authoritative; when UBLA is disabled,
    both IAM and ACL layers must be checked.
  confidence: '0.98'
  derived_from:
  - google.storage.Bucket iamPolicy.bindings (allUsers) or acl[].entity == 'allUsers'
  false_positive_note: "allUsers grants UNAUTHENTICATED access \u2014 any internet client can fetch objects\
    \ at https://storage.googleapis.com/{bucket}/{object} without any credentials. allAuthenticatedUsers\
    \ requires a Google account and is modeled separately as ExposedToTenant. When UBLA is disabled, both\
    \ the bucket IAM policy AND the bucket/object ACL arrays must be inspected; publicRead predefined\
    \ ACL (acl[].entity == 'allUsers') is equivalent to an IAM allUsers binding and must be detected.\
    \ When UBLA is enabled, object-level ACLs cannot override bucket IAM, so a bucket-level allUsers binding\
    \ exposes ALL objects. When UBLA is disabled, individual object ACLs may still restrict specific objects\
    \ \u2014 emit ExposedToInternet at the bucket level with a CONDITIONAL note when UBLA is off. Org\
    \ policy publicAccessPrevention == 'enforced' at the project/folder/org level prevents allUsers bindings\
    \ from being created and removes existing ones -> BLOCKED. Check publicAccessPrevention bucket field\
    \ directly."
  narrative: "Bucket {bucket.name} is publicly accessible \u2014 any unauthenticated internet client can\
    \ read its objects (allUsers IAM binding or publicRead ACL grants storage.objects.get without credentials)."