gcp-appengine-services-update

id: gcp-appengine-services-update
emits: CanModifyConfiguration
match_effective_permission:
  action: appengine.services.update
  resource_type: google.appengine.Application
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <App Engine application>
  permissions:
  - appengine.services.update
  conditions:
  - iam_permission
  escalation: Split/migrate serving traffic onto an attacker-controlled (or weaker existing) version,
    executing its code as the runtime SA without invoke perms.
  false_positive_note: 'services.update alone does not yield execution: it only routes traffic. Escalation
    requires an attacker-controllable or independently exploitable version to receive that traffic (trigger_exists
    analog). Absent such a version this edge is config-control only, not code execution. The derived gcp-appengine-execute-as-traffic
    rule must carry CONDITIONAL(trigger_exists) when no attacker-controlled/weaker version is present.

    '
  narrative: '{principal.name} can change App Engine serving/traffic config (appengine.services.update)
    and route traffic to a chosen version.'