gcp-run-vpc-egress
Cloud Run resource with Direct VPC egress / Serverless VPC Access connector can reach private targets.
match (record)
{
"field": "spec.vpcAccess",
"resource_type": "google.cloud.run.Service"
}
where
resource has a Serverless VPC Access connector or Direct VPC egress configured
emit
| source | <Cloud Run service/job> |
|---|---|
| target | <private resource reachable via the connected subnet> |
| conditions | network_reachability |
Narrative
{resource.name} has VPC egress and can reach private resources in the connected network.
Raw rule rules/derived/gcp/cloudrun.yaml
id: gcp-run-vpc-egress
emits: CanNetworkReach
description: Cloud Run resource with Direct VPC egress / Serverless VPC Access connector can reach private
targets.
match_record:
resource_type: google.cloud.run.Service
field: spec.vpcAccess
where:
- resource has a Serverless VPC Access connector or Direct VPC egress configured
emit:
source: <Cloud Run service/job>
target: <private resource reachable via the connected subnet>
conditions:
- network_reachability
note: Combined with CanExecuteAs, attacker code egresses into the VPC to reach otherwise-private DBs/hosts
(PrivateReachability).
narrative: '{resource.name} has VPC egress and can reach private resources in the connected network.'