rage.fail

gcp-appengine-execute-as-debug

Interactive debug/SSH on a Flexible instance yields code exec as the instance runtime SA.

derived gcp emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteCommand {'instance': None} {'instance': None} ExecutesAs {'sa': None}

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<runtime service account>`
permissions	`appengine.instances.enableDebug`

Narrative

{principal.name} can open a debug shell on Flexible instance {instance.name} and run commands as {sa.name}.

Raw rule rules/derived/gcp/appengine.yaml

id: gcp-appengine-execute-as-debug
emits: CanExecuteAs
description: Interactive debug/SSH on a Flexible instance yields code exec as the instance runtime SA.
match:
- - principal: null
  - CanExecuteCommand
  - instance: null
- - instance: null
  - ExecutesAs
  - sa: null
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <runtime service account>
  permissions:
  - appengine.instances.enableDebug
  derived_from:
  - <CanExecuteCommand edge_id>
  - <ExecutesAs edge_id>
  narrative: '{principal.name} can open a debug shell on Flexible instance {instance.name} and run commands
    as {sa.name}.'