rage.fail

gcp-kms-contains-key

explicit gcp emits Contains

match (record)

{ "field": "cryptoKeys", "resource_type": "google.cloud.kms.KeyRing" }

emit

source type	`AdministrativeBoundary`
target type	`*`
source	`<KeyRing (AdministrativeBoundary / GenericBoundary container) node>`
target	`<CryptoKey node>`

Narrative

{keyring.name} contains key {key.name}.

Raw rule rules/explicit/gcp-kms.yaml

id: gcp-kms-contains-key
emits: Contains
applies_to:
- gcp
match_record:
  resource_type: google.cloud.kms.KeyRing
  field: cryptoKeys
emit:
  source_type: AdministrativeBoundary
  target_type: '*'
  source: <KeyRing (AdministrativeBoundary / GenericBoundary container) node>
  target: <CryptoKey node>
  api_source: cloudkms.projects.locations.keyRings.cryptoKeys.list
  evidence_field: name (keyRings/*/cryptoKeys/*)
  narrative: '{keyring.name} contains key {key.name}.'