gcp-memorystore-no-auth-data-read

When AUTH is disabled (the GCP default), any in-VPC client (Identity, Compute, Container, KubernetesWorkload) with network reachability to port 6379/6380 gains full unauthenticated Redis data-plane read access. No credential retrieval is needed.

derived gcp emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Cache`
source	`?principal`
target	`?instance`
conditions	`network_reachability`
state logic	ACTIVE when: both ?principal and ?instance are LocatedIn the same VPC, AUTH is disabled (authEnabled == false) on the instance, and VPC topology confirms port 6379/6380 reachability (no blocking firewall rule). CONDITIONAL(network_reachability) when VPC topology is unresolved (e.g., peering or firewall rules not fully collected). Do NOT emit if instance.authEnabled == true (use gcp-memorystore-auth-string- grants-data-read instead).

source type

Identity

target type

Cache

source

?principal

target

?instance

conditions

network_reachability

state logic

ACTIVE when: both ?principal and ?instance are LocatedIn the same VPC, AUTH is disabled (authEnabled == false) on the instance, and VPC topology confirms port 6379/6380 reachability (no blocking firewall rule). CONDITIONAL(network_reachability) when VPC topology is unresolved (e.g., peering or firewall rules not fully collected). Do NOT emit if instance.authEnabled == true (use gcp-memorystore-auth-string- grants-data-read instead).

Narrative

{principal.name} is in VPC {vpc.name}, where {instance.name} is also located. AUTH is disabled on {instance.name}; any in-VPC client with network reach to port 6379/6380 can connect without credentials and read all keys.

Raw rule rules/derived/gcp/memorystore.yaml

id: gcp-memorystore-no-auth-data-read
emits: CanReadData
description: When AUTH is disabled (the GCP default), any in-VPC client (Identity, Compute, Container,
  KubernetesWorkload) with network reachability to port 6379/6380 gains full unauthenticated Redis data-plane
  read access. No credential retrieval is needed.
match:
- - principal: null
  - LocatedIn
  - vpc: null
- - instance: null
  - LocatedIn
  - vpc: null
where:
- node_class(?principal) in [Identity, Compute]
- node_type(?instance) == Cache
- ?instance.authEnabled == false
- ?principal has network reachability to ?instance.host on port 6379 or 6380
emit:
  source_type: Identity
  target_type: Cache
  source: ?principal
  target: ?instance
  permissions: []
  conditions:
  - network_reachability
  state_logic: 'ACTIVE when: both ?principal and ?instance are LocatedIn the same VPC, AUTH is disabled
    (authEnabled == false) on the instance, and VPC topology confirms port 6379/6380 reachability (no
    blocking firewall rule). CONDITIONAL(network_reachability) when VPC topology is unresolved (e.g.,
    peering or firewall rules not fully collected). Do NOT emit if instance.authEnabled == true (use gcp-memorystore-auth-string-
    grants-data-read instead).'
  confidence: min(contributing_confidences) * 0.9
  derived_from:
  - '<LocatedIn edge: principal -> vpc>'
  - '<LocatedIn edge: instance -> vpc>'
  - <instance.authEnabled == false>
  false_positive_note: "Emit ONLY when instance.authEnabled is false (the condition for unauthenticated\
    \ access). Do NOT conflate with the AUTH-string path. There is no control-plane IAM permission required\
    \ \u2014 network reach alone is sufficient. If the VPC topology does not confirm reachability, emit\
    \ CONDITIONAL(network_reachability), not ACTIVE. This CanReadData edge implies full Redis read command\
    \ access (GET, SCAN, KEYS) from the in-VPC position. Do NOT gate on key_permission (Memorystore does\
    \ not support CMEK)."
  narrative: '{principal.name} is in VPC {vpc.name}, where {instance.name} is also located. AUTH is disabled
    on {instance.name}; any in-VPC client with network reach to port 6379/6380 can connect without credentials
    and read all keys.'