GCP Artifact Registry repositories are anonymously or publicly accessible misconfiguration detected

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_101
Category - Subcategory	Public Exposure - Storage Buckets
Provider	GCP
Severity	HIGH
Framework	Terraform

Impact

Ensure that Artifact Registry repositories are not anonymously or publicly accessible

How to Fix

Resource: google_artifact_registry_repository_iam_binding

• Field: members
• Resource: google_storage_bucket_iam_member
• Field: member [source,go]

---

resource "google_artifact_registry_repository_iam_binding" "public_binding" { provider = google-beta location = google_artifact_registry_repository.my-repo.location repository = google_artifact_registry_repository.my-repo.name role = "roles/artifactregistry.writer"

members = [

• "allUsers",
• "allAuthenticatedUsers", ] }

---

resource "google_artifact_registry_repository_iam_member" "public_member" { provider = google-beta location = google_artifact_registry_repository.my-repo.location repository = google_artifact_registry_repository.my-repo.name role = "roles/artifactregistry.writer"

• member = "allUsers"
• member = "allAuthenticatedUsers" }

---