gcp-vpc-external-lb-exposed

id: gcp-vpc-external-lb-exposed
emits: ExposedToInternet
description: A forwarding rule with loadBalancingScheme EXTERNAL and an assigned external IP exposes the
  backend service to the public internet.
applies_to:
- gcp
match_record:
  resource_type: compute.googleapis.com/ForwardingRule
  field: loadBalancingScheme
where:
- forwardingRule.loadBalancingScheme in [EXTERNAL, EXTERNAL_MANAGED]
- forwardingRule.IPAddress is set (non-empty external IP)
- forwardingRule.target or forwardingRule.backendService is set
emit:
  source_type: LoadBalancer
  target_type: AnonymousIdentity
  source: <ForwardingRule node>
  target: "<AnonymousIdentity \u2014 internet>"
  permissions: []
  conditions: []
  state_logic: "ACTIVE \u2014 an external forwarding rule with an assigned external IP is publicly reachable\
    \ by definition."
  confidence: '0.95'
  derived_from:
  - '<ForwardingRule record: loadBalancingScheme=EXTERNAL, IPAddress set>'
  false_positive_note: "(1) Cloud Armor security policies attached to the backend service may block most\
    \ internet traffic. The exposure FACT is still ACTIVE; analysts may lower the exploitability score\
    \ when a WAF policy is present, but the edge itself is correct. (2) An internal forwarding rule (loadBalancingScheme=INTERNAL\
    \ or INTERNAL_MANAGED) is NOT internet-facing \u2014 do not emit ExposedToInternet. (3) Protocol-forwarding\
    \ rules (target=TargetInstance) with an EXTERNAL scheme do count \u2014 the instance is directly reachable."
  narrative: Forwarding rule {forwardingRule.name} (external IP {ip}) exposes the backend to the public
    internet. Any unauthenticated internet user can send traffic to this IP, which is forwarded to the
    backend workload.