gcp-kms-public-binding
A key allow policy binding allUsers/allAuthenticatedUsers to a crypto role exposes it broadly.
match (record)
{
"field": "iamPolicy.bindings",
"resource_type": "google.cloud.kms.CryptoKey"
}
where
a binding on the key (or inherited keyRing/project) grants a cloudkms.* crypto or admin role to allUsers or allAuthenticatedUsers
emit
| source type | * |
|---|---|
| source | <CryptoKey> |
| target | <Tenant/Organization> |
| permissions | cloudkms.cryptoKeyVersions.useToDecrypt cloudkms.cryptoKeyVersions.useToSign |
| conditions | resource_policy |
| state logic | ACTIVE if the wildcard binding is present and not overridden by an IAM deny / DOMAIN_RESTRICTED_SHARING org policy / VPC-SC perimeter; else BLOCKED. |
Narrative
Key {key.name} grants crypto use to any Google-authenticated principal (allUsers/allAuthenticatedUsers) - tenant-wide exposure.
Raw rule rules/derived/gcp/kms.yaml
id: gcp-kms-public-binding
emits: ExposedToTenant
description: A key allow policy binding allUsers/allAuthenticatedUsers to a crypto role exposes it broadly.
match_record:
resource_type: google.cloud.kms.CryptoKey
field: iamPolicy.bindings
where:
- a binding on the key (or inherited keyRing/project) grants a cloudkms.* crypto or admin role to allUsers
or allAuthenticatedUsers
emit:
source_type: '*'
source: <CryptoKey>
target: <Tenant/Organization>
permissions:
- cloudkms.cryptoKeyVersions.useToDecrypt
- cloudkms.cryptoKeyVersions.useToSign
conditions:
- resource_policy
state_logic: ACTIVE if the wildcard binding is present and not overridden by an IAM deny / DOMAIN_RESTRICTED_SHARING
org policy / VPC-SC perimeter; else BLOCKED.
confidence: '0.9'
derived_from:
- <key iamPolicy binding to allUsers/allAuthenticatedUsers>
false_positive_note: "allAuthenticatedUsers = any Google account (tenant/org-wide), NOT anonymous internet\
\ \u2014 Cloud KMS has no anonymous data plane, so model as ExposedToTenant, NEVER ExposedToInternet.\
\ A DOMAIN_RESTRICTED_SHARING org policy or VPC-SC perimeter can neutralize the wildcard -> BLOCKED."
narrative: "Key {key.name} grants crypto use to any Google-authenticated principal (allUsers/allAuthenticatedUsers)\
\ \u2014 tenant-wide exposure."