rage.fail

gcp-psc-service-attachment-auto-accept

explicit gcp emits CrossProjectTrust

match (record)

{ "field": "connectionPreference", "resource_type": "compute.googleapis.com/ServiceAttachment", "value": "ACCEPT_AUTOMATIC" }

emit

source type	`Project`
target type	`Project`
source	`<producer project>`
target	`<ExternalIdentity: any consumer project>`

Narrative

Service Attachment {service_attachment.name} uses ACCEPT_AUTOMATIC, implicitly trusting any consumer project that can reference its URI.

Raw rule rules/explicit/gcp-psc.yaml

id: gcp-psc-service-attachment-auto-accept
emits: CrossProjectTrust
applies_to:
- gcp
match_record:
  resource_type: compute.googleapis.com/ServiceAttachment
  field: connectionPreference
  value: ACCEPT_AUTOMATIC
emit:
  source_type: Project
  target_type: Project
  source: <producer project>
  target: '<ExternalIdentity: any consumer project>'
  api_source: compute.serviceAttachments.get
  evidence_field: connectionPreference
  narrative: Service Attachment {service_attachment.name} uses ACCEPT_AUTOMATIC, implicitly trusting any
    consumer project that can reference its URI.