Posture check: IBM Cloud Object Storage bucket is publicly readable through an access group
Query: ```config from cloud.resource where cloud.type = 'ibm' and api.name = 'ibm-iam-policy' AND json.rule = type equal ignore case "access" and roles[?any( role_id is member of ("crn:v1:bluemix:public:cloud-object-storage::::serviceRole:ObjectReader","crn:v1:bluemix:public:cloud-object-storage::::serviceRole:ContentReader") )] exists and resources[?any( attributes[?any( name equal ignore case "resourceType" and value equal ignore case "bucket" and operator is member of ("stringEquals", "stringMatch") )] exists )] exists and subjects[?any( attributes[?any( name contains "access_group_id" and value contains "AccessGroupId-PublicAccess")] exists )] exists as X; config from cloud.resource where api.name = 'ibm-object-storage-bucket' as Y; filter ' $.X.resources[*].attributes[*].value intersects $.Y.name and $.X.resources[*].attributes[*].value intersects $.Y.service_instance_id '; show Y;```