gcp-gcs-ubla-flag
explicit
gcp
emits
match (record)
{
"api": "storage.buckets.get",
"field": "iamConfiguration.uniformBucketLevelAccess.enabled",
"resource_type": "google.storage.Bucket"
}
emit
Raw rule rules/explicit/gcp-gcs.yaml
id: gcp-gcs-ubla-flag
emits: null
kind: evidence
applies_to:
- gcp
match_record:
api: storage.buckets.get
resource_type: google.storage.Bucket
field: iamConfiguration.uniformBucketLevelAccess.enabled
record:
on_node: <bucket / ObjectStorage node>
field: uniform_bucket_level_access
value: <true | false>
api_source: storage.buckets.get
evidence_field: iamConfiguration.uniformBucketLevelAccess.enabled
note: When true, only the bucket IAM policy is authoritative; legacy ACLs (acl / defaultObjectAcl) cannot
grant additional access. When false, both IAM and ACL layers must be evaluated by gcp-gcs-exposed-to-internet
and other rules that inspect ACL fields.