gcp-appengine-execute-as-deploy
Deploy a new App Engine version (attacker code) that executes as the runtime SA.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?instance belongs to a version of ?app (or a new version the principal creates on ?app)
?sa.privilege_level >= ?principal.privilege_level # escalation only
optional
Present → upgrade the emitted state; absent → downgrade (not a hard requirement).
{'principal': None}
CanModifyConfiguration {'app': None}
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <runtime service account> |
| permissions | appengine.versions.create |
| state logic | if matched(optional[0]) or new version auto-serves or trigger_exists(?app): ACTIVE else: CONDITIONAL(trigger_exists) # deployed but not receiving traffic yet |
Narrative
{principal.name} can deploy an App Engine version (appengine.versions.create) that runs as {sa.name}, executing attacker code with that SA's permissions.
Raw rule rules/derived/gcp/appengine.yaml
id: gcp-appengine-execute-as-deploy
emits: CanExecuteAs
description: Deploy a new App Engine version (attacker code) that executes as the runtime SA.
match:
- - principal: null
- CanModifyCode
- app: null
- - instance: null
- ExecutesAs
- sa: null
where:
- ?instance belongs to a version of ?app (or a new version the principal creates on ?app)
- '?sa.privilege_level >= ?principal.privilege_level # escalation only'
optional:
- - principal: null
- CanModifyConfiguration
- app: null
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <runtime service account>
permissions:
- appengine.versions.create
state_logic: 'if matched(optional[0]) or new version auto-serves or trigger_exists(?app): ACTIVE else:
CONDITIONAL(trigger_exists) # deployed but not receiving traffic yet
'
conditions_from:
- app: null
- sa: null
confidence: min(contributing) * 0.95
derived_from:
- <CanModifyCode edge_id>
- <ExecutesAs edge_id>
false_positive_note: 'Escalation strength depends on the runtime SA''s ACTUAL roles (Editor not guaranteed).
If deploy is CONDITIONAL on build/storage perms, propagate that condition.
'
narrative: '{principal.name} can deploy an App Engine version (appengine.versions.create) that runs
as {sa.name}, executing attacker code with that SA''s permissions.'