Control: Ensure no open firewall rules allow ingress from 0.0.0.0/0 to any port without any specific target

powerpipe control run gcp_compliance.control.compute_firewall_rule_restrict_ingress_all_with_no_specific_target

powerpipe login
powerpipe control run gcp_compliance.control.compute_firewall_rule_restrict_ingress_all_with_no_specific_target --share

with ip_protocol_all as (
  select
   distinct name
  from
    gcp_compute_firewall
  where
    direction = 'INGRESS'
    and (
      source_ranges ?& array['0.0.0.0/0']
      or source_ranges ?& array['::0']
      or source_ranges ?& array['0.0.0.0']
      or source_ranges ?& array['0.0.0.0/0']
      or source_ranges ?& array['::/0']
      or source_ranges ?& array['::']
    )
    and target_tags is null
    and allowed is not null
    and target_service_accounts is null
  )
select
  self_link resource,
  case
    when name in (select name from ip_protocol_all) then 'alarm'
    else 'ok'
  end as status,
  case
    when name in (select name from ip_protocol_all) then title || ' allows ingress from internet with no specific target.'
    else title || ' restricts ingress from internet with no specific target.'
  end as reason
  , location as location, project as project
from
  gcp_compute_firewall;