fix gcp gcs rules

j3ttt · j3ttt · commit 4680dff95f5f · 2025-06-12T10:53:36.000+08:00
diff --git a/rules/GCP/GCP_Cloud Storage_202501081111_515112/policy.rego b/rules/GCP/GCP_Cloud Storage_202501081111_515112/policy.rego
@@ -22,10 +22,10 @@ risk if {
 }
 
 isEnforcedPublicAccessPrevention if {
-    input.Item.iamConfiguration.publicAccessPrevention == "enforced"
+    input.Bucket.iamConfiguration.publicAccessPrevention == "enforced"
 }
 isBucketLevelAccessEnabled if {
-    input.Item.iamConfiguration.uniformBucketLevelAccess.enabled == true
+    input.Bucket.iamConfiguration.uniformBucketLevelAccess.enabled == true
 }
 
 unrestrictedPrincipal := {"allUsers", "allAuthenticatedUsers"}
@@ -41,11 +41,11 @@ managedFolderIamPolicyWithUnrestrictedPrincipal if {
 }
 
 bucketAclWithUnrestrictedPrincipal if {
-    some acl in input.Item.acl
+    some acl in input.Bucket.acl
     unrestrictedPrincipal[acl.entity]
 }
 
 defaultObjectAclWithUnrestrictedPrincipal if {
-    some acl in input.Item.defaultObjectAcl
+    some acl in input.Bucket.defaultObjectAcl
     unrestrictedPrincipal[acl.entity]
 }
diff --git a/rules/GCP/GCP_Cloud Storage_202501081111_944239/policy.rego b/rules/GCP/GCP_Cloud Storage_202501081111_944239/policy.rego
@@ -7,5 +7,5 @@ risk if {
 }
 
 isBucketLevelAccessEnabled if {
-    input.Item.iamConfiguration.uniformBucketLevelAccess.enabled == true
+    input.Bucket.iamConfiguration.uniformBucketLevelAccess.enabled == true
 }
diff --git a/rules/GCP/GCP_Cloud Storage_202501081111_997522/policy.rego b/rules/GCP/GCP_Cloud Storage_202501081111_997522/policy.rego
@@ -13,10 +13,10 @@ risk if {
 }
 
 isEnforcedPublicAccessPrevention if {
-    input.Item.iamConfiguration.publicAccessPrevention == "enforced"
+    input.Bucket.iamConfiguration.publicAccessPrevention == "enforced"
 }
 isBucketLevelAccessEnabled if {
-    input.Item.iamConfiguration.uniformBucketLevelAccess.enabled == true
+    input.Bucket.iamConfiguration.uniformBucketLevelAccess.enabled == true
 }
 
 unrestrictedPrincipal := {"allUsers", "allAuthenticatedUsers"}
@@ -25,6 +25,6 @@ iamPolicyWithUnrestrictedPrincipal if {
     unrestrictedPrincipal[binding.members[_]]
 }
 bucketAclWithUnrestrictedPrincipal if {
-    some acl in input.Item.acl
+    some acl in input.Bucket.acl
     unrestrictedPrincipal[acl.entity]
 }

Original file line number	Diff line number	Diff line change
`@@ -22,10 +22,10 @@ risk if {`
`22`	`22`	`}`
`23`	`23`
`24`	`24`	`isEnforcedPublicAccessPrevention if {`
`25`		`- input.Item.iamConfiguration.publicAccessPrevention == "enforced"`
	`25`	`+ input.Bucket.iamConfiguration.publicAccessPrevention == "enforced"`
`26`	`26`	`}`
`27`	`27`	`isBucketLevelAccessEnabled if {`
`28`		`- input.Item.iamConfiguration.uniformBucketLevelAccess.enabled == true`
	`28`	`+ input.Bucket.iamConfiguration.uniformBucketLevelAccess.enabled == true`
`29`	`29`	`}`
`30`	`30`
`31`	`31`	`unrestrictedPrincipal := {"allUsers", "allAuthenticatedUsers"}`
`@@ -41,11 +41,11 @@ managedFolderIamPolicyWithUnrestrictedPrincipal if {`
`41`	`41`	`}`
`42`	`42`
`43`	`43`	`bucketAclWithUnrestrictedPrincipal if {`
`44`		`- some acl in input.Item.acl`
	`44`	`+ some acl in input.Bucket.acl`
`45`	`45`	`unrestrictedPrincipal[acl.entity]`
`46`	`46`	`}`
`47`	`47`
`48`	`48`	`defaultObjectAclWithUnrestrictedPrincipal if {`
`49`		`- some acl in input.Item.defaultObjectAcl`
	`49`	`+ some acl in input.Bucket.defaultObjectAcl`
`50`	`50`	`unrestrictedPrincipal[acl.entity]`
`51`	`51`	`}`
Original file line number	Diff line number	Diff line change
`@@ -7,5 +7,5 @@ risk if {`
`7`	`7`	`}`
`8`	`8`
`9`	`9`	`isBucketLevelAccessEnabled if {`
`10`		`- input.Item.iamConfiguration.uniformBucketLevelAccess.enabled == true`
	`10`	`+ input.Bucket.iamConfiguration.uniformBucketLevelAccess.enabled == true`
`11`	`11`	`}`
Original file line number	Diff line number	Diff line change
`@@ -13,10 +13,10 @@ risk if {`
`13`	`13`	`}`
`14`	`14`
`15`	`15`	`isEnforcedPublicAccessPrevention if {`
`16`		`- input.Item.iamConfiguration.publicAccessPrevention == "enforced"`
	`16`	`+ input.Bucket.iamConfiguration.publicAccessPrevention == "enforced"`
`17`	`17`	`}`
`18`	`18`	`isBucketLevelAccessEnabled if {`
`19`		`- input.Item.iamConfiguration.uniformBucketLevelAccess.enabled == true`
	`19`	`+ input.Bucket.iamConfiguration.uniformBucketLevelAccess.enabled == true`
`20`	`20`	`}`
`21`	`21`
`22`	`22`	`unrestrictedPrincipal := {"allUsers", "allAuthenticatedUsers"}`
`@@ -25,6 +25,6 @@ iamPolicyWithUnrestrictedPrincipal if {`
`25`	`25`	`unrestrictedPrincipal[binding.members[_]]`
`26`	`26`	`}`
`27`	`27`	`bucketAclWithUnrestrictedPrincipal if {`
`28`		`- some acl in input.Item.acl`
	`28`	`+ some acl in input.Bucket.acl`
`29`	`29`	`unrestrictedPrincipal[acl.entity]`
`30`	`30`	`}`