gcp-workflows-public-invoke
An IAM binding granting roles/workflows.invoker to allUsers or allAuthenticatedUsers makes the workflow internet-invocable.
match (record)
{
"field": "iamPolicy.bindings",
"resource_type": "google.workflows.type.Workflow"
}
where
a binding grants roles/workflows.invoker (or workflows.executions.create) to allUsers or allAuthenticatedUsers
emit
| source type | Messaging |
|---|---|
| target type | AnonymousIdentity |
| source | <workflow> |
| target | <AnonymousIdentity> |
| conditions | network_reachability |
| state logic | ACTIVE when the IAM binding unconditionally grants roles/workflows.invoker to allUsers or allAuthenticatedUsers. CONDITIONAL when scoped by an IAM condition. BLOCKED by an org policy denying allUsers grants (e.g. constraints/iam.allowedPolicyMemberDomains). |
Narrative
{workflow.name} is invocable from the public internet (allUsers/allAuthenticatedUsers has roles/workflows.invoker), running steps as the runtime service account with any caller-supplied argument payload.
Raw rule rules/derived/gcp/workflows.yaml
id: gcp-workflows-public-invoke
emits: ExposedToInternet
description: An IAM binding granting roles/workflows.invoker to allUsers or allAuthenticatedUsers makes
the workflow internet-invocable.
match_record:
resource_type: google.workflows.type.Workflow
field: iamPolicy.bindings
where:
- a binding grants roles/workflows.invoker (or workflows.executions.create) to allUsers or allAuthenticatedUsers
emit:
source_type: Messaging
target_type: AnonymousIdentity
source: <workflow>
target: <AnonymousIdentity>
permissions: []
conditions:
- network_reachability
state_logic: ACTIVE when the IAM binding unconditionally grants roles/workflows.invoker to allUsers
or allAuthenticatedUsers. CONDITIONAL when scoped by an IAM condition. BLOCKED by an org policy denying
allUsers grants (e.g. constraints/iam.allowedPolicyMemberDomains).
false_positive_note: "allAuthenticatedUsers = any valid Google account, not anonymous internet traffic;\
\ still broadly abusable. IAM Org Policy constraints/iam.allowedPolicyMemberDomains blocks allUsers/allAuthenticatedUsers\
\ grants \u2014 check org policy before emitting ACTIVE. Workflow is Messaging-class; ExposedToInternet\
\ source set includes Messaging."
narrative: '{workflow.name} is invocable from the public internet (allUsers/allAuthenticatedUsers has
roles/workflows.invoker), running steps as the runtime service account with any caller-supplied argument
payload.'