GCP BigQuery Dataset Opened to Public

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•1•0•92

This rule detects when a Google Cloud Platform (GCP) BigQuery dataset's access policy is modified to include 'allUsers' or 'allAuthenticatedUsers'. This action effectively makes the dataset publicly accessible, which can lead to unauthorized data exposure and potential data exfiltration. The rule specifically looks for 'IAMPolicy.SetIamPolicy' events on BigQuery resources where a binding delta adds a role (e.g., 'roles/bigquery.dataViewer') to either 'allUsers' or 'allAuthenticatedUsers'.