rage.fail

gcp-ar-cross-project-binding

explicit gcp emits CrossProjectTrust

match (record)

{ "field": "iamPolicy.bindings", "resource_type": "google.artifactregistry.Repository" }

where

binding member is serviceAccount:*@<PROJECT_ID>.iam.gserviceaccount.com where PROJECT_ID != repository's project binding role includes artifactregistry.repositories.uploadArtifacts (roles/artifactregistry.writer, roles/artifactregistry.repoAdmin, roles/artifactregistry.admin, or a custom role with that permission)

emit

source type	`ResourcePolicy`
target type	`Project`
source	`<ResourcePolicy of the Artifact Registry repository>`
target	`<GCP project of the external ServiceAccount>`

Narrative

Repository {repo.name} (project {repo.project}) grants write access via {role} to service account {cross_project_sa} from project {sa.project}; a principal that can act as {cross_project_sa} can push to {repo.name} and poison workloads in {repo.project}.

Raw rule rules/explicit/gcp-artifactregistry.yaml

id: gcp-ar-cross-project-binding
emits: CrossProjectTrust
applies_to:
- gcp
match_record:
  resource_type: google.artifactregistry.Repository
  field: iamPolicy.bindings
where:
- binding member is serviceAccount:*@<PROJECT_ID>.iam.gserviceaccount.com where PROJECT_ID != repository's
  project
- binding role includes artifactregistry.repositories.uploadArtifacts (roles/artifactregistry.writer,
  roles/artifactregistry.repoAdmin, roles/artifactregistry.admin, or a custom role with that permission)
emit:
  source_type: ResourcePolicy
  target_type: Project
  source: <ResourcePolicy of the Artifact Registry repository>
  target: <GCP project of the external ServiceAccount>
  api_source: artifactregistry.projects.locations.repositories.getIamPolicy
  evidence_field: iamPolicy.bindings[].members (cross-project serviceAccount)
  properties:
    cross_project_sa: <serviceAccount member string>
    role: <binding role>
  narrative: Repository {repo.name} (project {repo.project}) grants write access via {role} to service
    account {cross_project_sa} from project {sa.project}; a principal that can act as {cross_project_sa}
    can push to {repo.name} and poison workloads in {repo.project}.