gcp-acm-can-modify-access-level

explicit gcp emits CanModifyPolicy

match (effective permission)

{ "any_of": [ { "action": "accesscontextmanager.accessLevels.update", "resource_type": "google.identity.accesscontextmanager.v1.AccessPolicy" }, { "action": "accesscontextmanager.accessLevels.delete", "resource_type": "google.identity.accesscontextmanager.v1.AccessPolicy" }, { "action": "accesscontextmanager.accessLevels.create", "resource_type": "google.identity.accesscontextmanager.v1.AccessPolicy" } ] }

where

the access level is referenced by >=1 ingress rule in an enforced PERIMETER_TYPE_REGULAR perimeter (for update/delete); or the principal can modify ingress rules to reference the new level (for create)

emit

source type	`Identity`
target type	`ConditionalPolicy`
source	`<principal>`
target	`<AccessLevel ConditionalPolicy node>`
permissions	`accesscontextmanager.accessLevels.update` `accesscontextmanager.accessLevels.delete` `accesscontextmanager.accessLevels.create`
conditions	`iam_permission`
state logic	ACTIVE for accessLevels.update (broadening conditions clearly weakens the access level); CONDITIONAL(collector_verification) for accessLevels.delete — deleting a referenced access level may break the ingress rule rather than open it; state is CONDITIONAL until the collector confirms the perimeter's behavior. Create: CONDITIONAL(servicePerimeters.update) — creating a permissive access level only opens the perimeter if an ingress rule can be modified to reference it.

Narrative

{principal.name} can update, delete, or create Access Levels (accessLevels.update / .delete / .create), indirectly weakening or removing guardrail conditions on perimeter ingress rules. Weakening (.update) clearly opens the ingress path; deletion behavior is implementation-specific.

Raw rule rules/explicit/gcp-accesscontextmanager.yaml

id: gcp-acm-can-modify-access-level
emits: CanModifyPolicy
applies_to:
- gcp
match_effective_permission:
  any_of:
  - action: accesscontextmanager.accessLevels.update
    resource_type: google.identity.accesscontextmanager.v1.AccessPolicy
  - action: accesscontextmanager.accessLevels.delete
    resource_type: google.identity.accesscontextmanager.v1.AccessPolicy
  - action: accesscontextmanager.accessLevels.create
    resource_type: google.identity.accesscontextmanager.v1.AccessPolicy
where:
- the access level is referenced by >=1 ingress rule in an enforced PERIMETER_TYPE_REGULAR perimeter (for
  update/delete); or the principal can modify ingress rules to reference the new level (for create)
emit:
  source_type: Identity
  target_type: ConditionalPolicy
  source: <principal>
  target: <AccessLevel ConditionalPolicy node>
  api_source: "IAM Policy Analyzer \u2014 effective accesscontextmanager.accessLevels.update / .delete\
    \ / .create at the access policy"
  permissions:
  - accesscontextmanager.accessLevels.update
  - accesscontextmanager.accessLevels.delete
  - accesscontextmanager.accessLevels.create
  state_logic: "ACTIVE for accessLevels.update (broadening conditions clearly weakens the access level);\
    \ CONDITIONAL(collector_verification) for accessLevels.delete \u2014 deleting a referenced access\
    \ level may break the ingress rule rather than open it; state is CONDITIONAL until the collector confirms\
    \ the perimeter's behavior. Create: CONDITIONAL(servicePerimeters.update) \u2014 creating a permissive\
    \ access level only opens the perimeter if an ingress rule can be modified to reference it."
  conditions:
  - iam_permission
  confidence: 0.75
  derived_from:
  - "IAM Policy Analyzer \u2014 effective accesscontextmanager.accessLevels.update / .delete / .create\
    \ at access policy"
  false_positive_note: "Deletion nuance (from providers/gcp/accesscontextmanager.md \xA722.7): deleting\
    \ a referenced access level may break the ingress rule (rule is unsatisfied) rather than open it.\
    \ Prefer modeling .update (broadening) as the cleaner guardrail-weakening path. For .delete, emit\
    \ CONDITIONAL pending collector verification. For .create, emit only if the principal can also modify\
    \ ingress rules (servicePerimeters.update) to reference the new level."
  narrative: '{principal.name} can update, delete, or create Access Levels (accessLevels.update / .delete
    / .create), indirectly weakening or removing guardrail conditions on perimeter ingress rules. Weakening
    (.update) clearly opens the ingress path; deletion behavior is implementation-specific.'