GCP Compute Image Opened to Public

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•2•0•72

This rule detects when a Google Cloud Platform (GCP) Compute Engine image's access policy is modified to include 'allAuthenticatedUsers'. This action effectively makes the image publicly accessible to any authenticated Google user, which could lead to unauthorized access or data exfiltration if sensitive data is present in the image.