rage.fail

gcp-appengine-instances-enable-debug

derived gcp emits CanExecuteCommand

match (effective permission)

{ "action": "appengine.instances.enableDebug", "resource_type": "google.appengine.Instance" }

where

version.env is flexible (vm:true); Standard-env instances have no SSH/debug shell

emit

source type	`Identity`
source	`<principal>`
target	`<App Engine flexible instance>`
permissions	`appengine.instances.enableDebug`
conditions	`service_state`

Narrative

{principal.name} can open an interactive debug/SSH shell on App Engine Flexible instance {instance.name} (appengine.instances.enableDebug).

Raw rule rules/derived/gcp/appengine.yaml

id: gcp-appengine-instances-enable-debug
emits: CanExecuteCommand
match_effective_permission:
  action: appengine.instances.enableDebug
  resource_type: google.appengine.Instance
where:
- version.env is flexible (vm:true); Standard-env instances have no SSH/debug shell
emit:
  source_type: Identity
  source: <principal>
  target: <App Engine flexible instance>
  permissions:
  - appengine.instances.enableDebug
  conditions:
  - service_state
  false_positive_note: enableDebug yields a shell ONLY on Flexible-environment instances. Do not emit
    for Standard-env versions.
  narrative: '{principal.name} can open an interactive debug/SSH shell on App Engine Flexible instance
    {instance.name} (appengine.instances.enableDebug).'