DET-R4: Repository opened to everyone or another account¶
A repository policy now allows any principal or a foreign account (ECR), or allUsers / allAuthenticatedUsers (Artifact Registry): anyone named can pull, or push, what the TEE boots.
| Property | Value |
|---|---|
| Severity | high |
| Platform | Image registry |
| Group | supply |
| Log source | CloudTrail · ECR / Cloud Audit Logs · Artifact Registry |
| Related check | REG-ACCESS-01: Artifact metadata is readable |
Fires when¶
a watched repository was opened to everyone or shared to another account
How it runs¶
untrust registry detect --policy <trust policy> reads registry audit events for the repositories the policy watches.
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.