rage.fail

gcp-psc-service-attachment-cross-project-trust

explicit gcp emits CrossProjectTrust

match (record)

{ "field": "consumerAcceptLists[].projectIdOrNum", "resource_type": "compute.googleapis.com/ServiceAttachment" }

where

connectionPreference == ACCEPT_MANUAL consumerAcceptLists[].projectIdOrNum is different from the producer project

emit

source type	`Project`
target type	`Project`
source	`<producer project>`
target	`<allowed consumer project>`

Narrative

Service Attachment {service_attachment.name} explicitly allows consumer project {consumer_project} to connect (ACCEPT_MANUAL, consumerAcceptLists).

Raw rule rules/explicit/gcp-psc.yaml

id: gcp-psc-service-attachment-cross-project-trust
emits: CrossProjectTrust
applies_to:
- gcp
match_record:
  resource_type: compute.googleapis.com/ServiceAttachment
  field: consumerAcceptLists[].projectIdOrNum
where:
- connectionPreference == ACCEPT_MANUAL
- consumerAcceptLists[].projectIdOrNum is different from the producer project
emit:
  source_type: Project
  target_type: Project
  source: <producer project>
  target: <allowed consumer project>
  api_source: compute.serviceAttachments.get
  evidence_field: consumerAcceptLists[].projectIdOrNum
  narrative: Service Attachment {service_attachment.name} explicitly allows consumer project {consumer_project}
    to connect (ACCEPT_MANUAL, consumerAcceptLists).