rage.fail

gcp-appengine-versions-update

derived gcp emits CanModifyConfiguration

match (effective permission)

{ "action": "appengine.versions.update", "resource_type": "google.appengine.Application" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<App Engine application>`
permissions	`appengine.versions.update`
conditions	`iam_permission`

Narrative

{principal.name} can modify an App Engine version's serving/scaling config (appengine.versions.update); this alone cannot rebind the runtime SA or inject code.

Raw rule rules/derived/gcp/appengine.yaml

id: gcp-appengine-versions-update
emits: CanModifyConfiguration
match_effective_permission:
  action: appengine.versions.update
  resource_type: google.appengine.Application
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <App Engine application>
  permissions:
  - appengine.versions.update
  conditions:
  - iam_permission
  false_positive_note: 'appengine.versions.update changes serving/scaling config only; it CANNOT rebind
    the runtime SA on an existing version nor inject new code by itself. Real code execution requires
    pairing with appengine.versions.create. Do not feed this edge into CanExecuteAs derivations on its
    own.

    '
  narrative: '{principal.name} can modify an App Engine version''s serving/scaling config (appengine.versions.update);
    this alone cannot rebind the runtime SA or inject code.'