Google CloudOverview
Overview
Artifact Registry repositories should not be exposed to unauthenticated or broadly authenticated principals such as allUsers or allAuthenticatedUsers. Public repositories increase the blast radius of accidental image disclosure and make supply-chain reconnaissance easier for attackers.
Remediation guidance
From Google Cloud Console
- Open the affected Artifact Registry repository.
- Review IAM bindings on the repository.
- Remove
allUsersandallAuthenticatedUsersmembers. - Grant only the specific principals or service accounts that require repository access.
Using gcloud
gcloud artifacts repositories remove-iam-policy-binding <repository> --location=<location> --member=<member> --role=<role>
Query logic
These are the stored checks tied to this control.
Publicly accessible Artifact Registry repositories
Connectors
Google Cloud
Covered asset types
ArtifactRegistryRepository
Expected check: eq []
{ artifactRegistryRepositories(where: { iamBindings_SOME: { OR: [ { members_INCLUDES: "allAuthenticatedUsers" }, { members_INCLUDES: "allUsers" } ] } }) { ...AssetFragment } }
