Public buckets and datasets in Terraform

This rule flags any resource whose literal members or ACL make it readable by anyone: allUsers, allAuthenticatedUsers, public-read or public-read-write. It also flags publicly_accessible = true. A binding on an invoker role is skipped, because that makes an endpoint public, not data.

If the resource holds anything but deliberately public data, that data is public now. Terraform restores the binding on the next apply, so removing it by hand in the console does not last.

Close public access to data stores. Remove the public principal or ACL, and grant read access to named groups instead.

Before:

resource "google_storage_bucket_iam_member" "exports" {
  bucket = var.exports_bucket
  role   = "roles/storage.objectViewer"
  member = "allUsers"
}

After:

resource "google_storage_bucket_iam_member" "exports" {
  bucket = var.exports_bucket
  role   = "roles/storage.objectViewer"
  member = var.finance_readers
}

An open dataset published on purpose, such as public reference data, should be readable by anyone. Keep it in a resource of its own, named so the intent is plain. Tell us, and the finding comes out of your report.

The .tf files you supply, read for literal values only. A member or ACL set from a variable reads as unknown and is not flagged. We refuse .tfvars and state files by name.