rage.fail

gcp-kms-located-in

explicit gcp emits LocatedIn

match (record)

{ "field": "name (locations/*)", "resource_type": "google.cloud.kms.CryptoKey" }

where

key/ring name pins a location (locations/<region|global>)

emit

source type	`*`
source	`<CryptoKey node>`
target	`<location boundary>`

Narrative

{key.name} is located in {location} (KMS keys are location-scoped).

Raw rule rules/explicit/gcp-kms.yaml

id: gcp-kms-located-in
emits: LocatedIn
applies_to:
- gcp
match_record:
  resource_type: google.cloud.kms.CryptoKey
  field: name (locations/*)
where:
- key/ring name pins a location (locations/<region|global>)
emit:
  source_type: '*'
  source: <CryptoKey node>
  target: <location boundary>
  api_source: cloudkms.projects.locations.keyRings.cryptoKeys.list
  evidence_field: name
  narrative: '{key.name} is located in {location} (KMS keys are location-scoped).'