gcp-batch-create-workload-as
Create a new Batch job whose VMs run as a passable SA (create + actAs).
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?principal has batch.jobs.create in the target project/location
?principal has iam.serviceAccounts.actAs on ?sa
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <service account> |
| permissions | batch.jobs.create iam.serviceAccounts.actAs |
Narrative
{principal.name} can create a Batch job bound to {sa.name} (batch.jobs.create + iam.serviceAccounts.actAs), executing code as {sa.name}.
Raw rule rules/derived/gcp/batch.yaml
id: gcp-batch-create-workload-as
emits: CanCreateWorkloadAs
description: Create a new Batch job whose VMs run as a passable SA (create + actAs).
match:
- - principal: null
- CanPassIdentity
- sa: null
where:
- ?principal has batch.jobs.create in the target project/location
- ?principal has iam.serviceAccounts.actAs on ?sa
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <service account>
permissions:
- batch.jobs.create
- iam.serviceAccounts.actAs
escalation: Deploy a Batch job whose runtime SA is a privileged SA; it runs attacker code immediately.
false_positive_note: 'actAs must apply to the chosen SA. Without it -> POTENTIAL. The default Compute
Engine SA is not an exception: actAs is required on it too (per the official Batch custom-service-account
guide).'
narrative: '{principal.name} can create a Batch job bound to {sa.name} (batch.jobs.create + iam.serviceAccounts.actAs),
executing code as {sa.name}.'