rage.fail

gcp-kms-cross-project-trust

explicit gcp emits CrossProjectTrust

match (record)

{ "field": "iamPolicy.bindings[].members", "resource_type": "google.cloud.kms.CryptoKey" }

where

a member (user/SA/service-agent) belongs to a different project than the key

emit

source	`<key.project>`
target	`<member.project \| external identity>`

Narrative

{key.name} grants crypto use to {external.name} in project {project} (cross-project CMEK trust).

Raw rule rules/explicit/gcp-kms.yaml

id: gcp-kms-cross-project-trust
emits: CrossProjectTrust
applies_to:
- gcp
match_record:
  resource_type: google.cloud.kms.CryptoKey
  field: iamPolicy.bindings[].members
where:
- a member (user/SA/service-agent) belongs to a different project than the key
emit:
  source: <key.project>
  target: <member.project | external identity>
  api_source: cloudkms.projects.locations.keyRings.cryptoKeys.getIamPolicy
  evidence_field: iamPolicy.bindings[].members
  narrative: '{key.name} grants crypto use to {external.name} in project {project} (cross-project CMEK
    trust).'