rules-gcp

RISK: Exempting principals from Data Access audit logs creates blind spots in your Cloud Audit trail — forensics and compliance investigations can no longer reconstruct who accessed what data. FIX: Remove exempted_members unless there is a documented, risk-accepted reason for each principal; prefer logging all activity.

RISK: Binding allUsers to a Cloud Function or Cloud Run Function makes it publicly invocable without authentication — a common data-exfiltration vector when functions access databases or internal APIs. FIX: Remove the allUsers binding and require authentication via IAP, ID tokens, or a service-account invoker.

RISK: Binding roles/run.invoker to allUsers publishes the Cloud Run service to the anonymous internet. FIX: Confirm this is an intentionally public endpoint; otherwise restrict to specific service accounts or groups and front with IAP/API Gateway.

RISK: Cloud SQL instances with a public IPv4 address are routinely found by internet scanners and are a common exfiltration target. FIX: Set ipv4_enabled = false and access the instance via Private Service Connect, private IP, or the Cloud SQL Auth Proxy.

RISK: Committing a service-account JSON key to the repository hands attackers a persistent backdoor into the project. FIX: Delete the file, rotate the key in IAM immediately, and switch to Workload Identity Federation or ADC impersonation.

RISK: Scripts that mint service-account JSON keys create persistent, hard-to-rotate credentials that often end up in CI logs. FIX: Replace with 'gcloud auth application-default login --impersonate-service-account' or Workload Identity Federation.

RISK: GKE basic auth (username/password on master_auth) is removed in cluster versions >=1.19 and is a static credential that cannot be rotated safely. FIX: Remove username/password fields and rely on OAuth/OIDC authentication to the API server.

RISK: Issuing a static client certificate for GKE masters creates a long-lived credential that cannot be revoked without rebuilding the cluster. FIX: Set issue_client_certificate = false and authenticate with IAM/OIDC.

RISK: Legacy ABAC grants overly permissive authorization and bypasses Kubernetes RBAC, which GKE hardening guides flag as critical. FIX: Set enable_legacy_abac = false and define RBAC Role/RoleBinding resources.

RISK: allAuthenticatedUsers grants access to every Google account on the internet, not just your org — effectively public per Google's IAM guidance. FIX: Bind the role to a specific group, serviceAccount, or domain: principal instead.

RISK: Primitive roles (owner/editor/viewer) grant sweeping permissions across a project, violating least-privilege. FIX: Assign a predefined or custom role scoped to the specific resource and actions required.

RISK: Exposing RDP (3389) to 0.0.0.0/0 is regularly weaponised by ransomware crews against Windows VMs. FIX: Restrict source_ranges to a trusted CIDR or tunnel through IAP TCP forwarding.

RISK: Exposing SSH (22) to 0.0.0.0/0 invites brute-force and CVE scanning against VMs. FIX: Restrict source_ranges to a bastion/VPN CIDR or front SSH with Identity-Aware Proxy (IAP).

RISK: Granting allUsers the Storage Object Viewer role exposes the bucket to the public internet, a leading cause of GCP data leaks. FIX: Remove the allUsers binding and use signed URLs or named principals instead.

RISK: google_service_account_key provisions a long-lived JSON key; leaked keys are a top GCP compromise vector (Mandiant M-Trends 2025). FIX: Use Workload Identity Federation or service-account impersonation with short-lived tokens instead.

RISK: Metadata requests without the 'Metadata-Flavor: Google' header are vulnerable to SSRF-driven token theft, matching the class of attack used in the Capital One-style breaches. FIX: Always send the Metadata-Flavor: Google header (and prefer the official google-auth client libraries).

RISK: Disabling uniform_bucket_level_access re-enables object ACLs, which have historically leaked data by bypassing bucket IAM policies. FIX: Set uniform_bucket_level_access = true unless you have a documented ACL use case.

RISK: Subnets without VPC Flow Logs lose all visibility into network traffic — lateral movement, data exfiltration, and C2 beaconing are invisible without flow data. FIX: Add a log_config block with flow_sampling = 0.5 and metadata = INCLUDE_ALL_METADATA on every production subnet.