gcp-acm-can-set-iam-policy
match (effective permission)
{
"any_of": [
{
"action": "accesscontextmanager.policies.setIamPolicy",
"resource_type": "google.identity.accesscontextmanager.v1.AccessPolicy"
},
{
"action": "accesscontextmanager.accessPolicies.setIamPolicy",
"resource_type": "google.identity.accesscontextmanager.v1.AccessPolicy"
}
]
}
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <any Identity at access policy scope — self-grant target> |
| permissions | accesscontextmanager.policies.setIamPolicy accesscontextmanager.accessPolicies.setIamPolicy |
| conditions | iam_permission |
| state logic | ACTIVE when effective setIamPolicy is unconditionally held; CONDITIONAL(iam_permission) when gated by an IAM condition. |
Narrative
{principal.name} can set the IAM policy on the VPC-SC access policy (policies.setIamPolicy or accessPolicies.setIamPolicy) - can grant roles/accesscontextmanager.policyAdmin to itself or others, yielding full perimeter control.
Raw rule rules/explicit/gcp-accesscontextmanager.yaml
id: gcp-acm-can-set-iam-policy
emits: CanGrantPermission
applies_to:
- gcp
match_effective_permission:
any_of:
- action: accesscontextmanager.policies.setIamPolicy
resource_type: google.identity.accesscontextmanager.v1.AccessPolicy
- action: accesscontextmanager.accessPolicies.setIamPolicy
resource_type: google.identity.accesscontextmanager.v1.AccessPolicy
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: "<any Identity at access policy scope \u2014 self-grant target>"
api_source: "IAM Policy Analyzer \u2014 effective accesscontextmanager.policies.setIamPolicy or accessPolicies.setIamPolicy\
\ at the access policy"
permissions:
- accesscontextmanager.policies.setIamPolicy
- accesscontextmanager.accessPolicies.setIamPolicy
state_logic: ACTIVE when effective setIamPolicy is unconditionally held; CONDITIONAL(iam_permission)
when gated by an IAM condition.
conditions:
- iam_permission
confidence: 0.95
derived_from:
- "IAM Policy Analyzer \u2014 effective accesscontextmanager.policies.setIamPolicy or accessPolicies.setIamPolicy\
\ at the access policy"
false_positive_note: The downstream CanGrantPermission -> CanEscalateTo roll-up is handled by can-control.yaml
and gcp/identity-escalation.yaml; do not re-derive the escalation chain here. Verify the permission
is on the policies resource (access policy), not a per-perimeter resource. Both accesscontextmanager.policies.setIamPolicy
(v1 standard form) and accesscontextmanager.accessPolicies.setIamPolicy (alternative v1 form) are
functionally identical.
narrative: "{principal.name} can set the IAM policy on the VPC-SC access policy (policies.setIamPolicy\
\ or accessPolicies.setIamPolicy) \u2014 can grant roles/accesscontextmanager.policyAdmin to itself\
\ or others, yielding full perimeter control."