rage.fail

gcp-secretmanager-cross-project-trust

explicit gcp emits CrossProjectTrust

match (record)

{ "field": "iamPolicy.bindings[].members", "resource_type": "google.secretmanager.Secret" }

where

a member (user/SA/group) belongs to a different project than the secret

emit

source	`<secret.project>`
target	`<member.project \| external identity>`

Narrative

{secret.name} grants access to {external.name} in project {project}.

Raw rule rules/explicit/gcp-secretmanager.yaml

id: gcp-secretmanager-cross-project-trust
emits: CrossProjectTrust
applies_to:
- gcp
match_record:
  resource_type: google.secretmanager.Secret
  field: iamPolicy.bindings[].members
where:
- a member (user/SA/group) belongs to a different project than the secret
emit:
  source: <secret.project>
  target: <member.project | external identity>
  api_source: secretmanager.projects.secrets.getIamPolicy
  evidence_field: iamPolicy.bindings[].members
  narrative: '{secret.name} grants access to {external.name} in project {project}.'