rage.fail

gcp-batch-cross-project-create

A principal in project A creates a Batch job in project B whose runtime SA has power in B.

derived gcp emits CanEnterProject

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteAs {'sa': None}

where

?job.project != ?principal.project ?sa has bindings granting privilege in ?job.project

emit

source type	`Identity`
target type	`Project`
source	`<principal>`
target	`<job.project>`
permissions	`batch.jobs.create` `iam.serviceAccounts.actAs`

Narrative

{principal.name} can run code as {sa.name} in project {project.name} via a Batch job it creates, entering that project.

Raw rule rules/derived/gcp/batch.yaml

id: gcp-batch-cross-project-create
emits: CanEnterProject
description: A principal in project A creates a Batch job in project B whose runtime SA has power in B.
match:
- - principal: null
  - CanExecuteAs
  - sa: null
where:
- ?job.project != ?principal.project
- ?sa has bindings granting privilege in ?job.project
emit:
  source_type: Identity
  target_type: Project
  source: <principal>
  target: <job.project>
  permissions:
  - batch.jobs.create
  - iam.serviceAccounts.actAs
  false_positive_note: actAs is only needed when a non-default runtime SA is chosen (the usual cross-project
    case). Only cross-boundary when principal and job live in different projects AND the runtime SA is
    privileged in the job's project. Org policy iam.disableCrossProjectServiceAccountUsage can block cross-project
    SA use -> BLOCKED.
  narrative: '{principal.name} can run code as {sa.name} in project {project.name} via a Batch job it
    creates, entering that project.'