gcp-acm-can-get-iam-policy
match (effective permission)
{
"action": "accesscontextmanager.policies.getIamPolicy",
"resource_type": "google.identity.accesscontextmanager.v1.AccessPolicy"
}
emit
| source type | Identity |
|---|---|
| target type | ConditionalPolicy |
| source | <principal> |
| target | <AccessPolicy ConditionalPolicy node> |
| permissions | accesscontextmanager.policies.getIamPolicy |
| conditions | iam_permission |
| state logic | ACTIVE when effective getIamPolicy is held; low attack value (reconnaissance only — reveals who holds policyAdmin/policyEditor). |
Narrative
{principal.name} can read the IAM policy of the VPC-SC access policy (reconnaissance - who has policyAdmin / policyEditor).
Raw rule rules/explicit/gcp-accesscontextmanager.yaml
id: gcp-acm-can-get-iam-policy
emits: CanRead
applies_to:
- gcp
match_effective_permission:
action: accesscontextmanager.policies.getIamPolicy
resource_type: google.identity.accesscontextmanager.v1.AccessPolicy
emit:
source_type: Identity
target_type: ConditionalPolicy
source: <principal>
target: <AccessPolicy ConditionalPolicy node>
api_source: "IAM Policy Analyzer \u2014 effective accesscontextmanager.policies.getIamPolicy"
permissions:
- accesscontextmanager.policies.getIamPolicy
state_logic: "ACTIVE when effective getIamPolicy is held; low attack value (reconnaissance only \u2014\
\ reveals who holds policyAdmin/policyEditor)."
conditions:
- iam_permission
confidence: 0.7
derived_from:
- "IAM Policy Analyzer \u2014 effective accesscontextmanager.policies.getIamPolicy"
false_positive_note: This is a read-only reconnaissance edge; it does not enable guardrail removal on
its own. The value is in identifying who else has policyAdmin/policyEditor roles on the access policy.
narrative: "{principal.name} can read the IAM policy of the VPC-SC access policy (reconnaissance \u2014\
\ who has policyAdmin / policyEditor)."