rage.fail

gcp-appengine-escalate-rollup

App Engine execution-as a more-privileged SA rolls up to an escalation edge.

derived gcp emits CanEscalateTo

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteAs {'sa': None}

where

?sa.privilege_level > ?principal.privilege_level

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<runtime service account>`

Narrative

{principal.name} can escalate to {sa.name} via App Engine code execution.

Raw rule rules/derived/gcp/appengine.yaml

id: gcp-appengine-escalate-rollup
emits: CanEscalateTo
description: App Engine execution-as a more-privileged SA rolls up to an escalation edge.
match:
- - principal: null
  - CanExecuteAs
  - sa: null
where:
- ?sa.privilege_level > ?principal.privilege_level
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <runtime service account>
  derived_from:
  - <CanExecuteAs edge_id>
  narrative: '{principal.name} can escalate to {sa.name} via App Engine code execution.'