gcp-batch-execute-as-via-default-sa

Create a job WITHOUT specifying a runtime SA -> runs as the Compute Engine default SA (usually roles/editor).

derived gcp emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<Compute Engine default service account>`
permissions	`batch.jobs.create` `iam.serviceAccounts.actAs`
conditions	`iam_permission`
state logic	CONDITIONAL(iam_permission) by default -- creating a job with the default Compute Engine SA still requires iam.serviceAccounts.actAs on that default SA (per the Batch custom-service-account guide). ACTIVE only when the caller actually holds actAs on the default Compute Engine SA; otherwise POTENTIAL/CONDITIONAL(iam_permission).

source type

Identity

target type

Identity

source

<principal>

target

<Compute Engine default service account>

permissions

batch.jobs.create iam.serviceAccounts.actAs

conditions

iam_permission

state logic

CONDITIONAL(iam_permission) by default -- creating a job with the default Compute Engine SA still requires iam.serviceAccounts.actAs on that default SA (per the Batch custom-service-account guide). ACTIVE only when the caller actually holds actAs on the default Compute Engine SA; otherwise POTENTIAL/CONDITIONAL(iam_permission).

Narrative

{principal.name} can create a Batch job without a custom SA (batch.jobs.create); its VMs run attacker code as the default Compute Engine SA {sa.name} (typically roles/editor).

Raw rule rules/derived/gcp/batch.yaml

id: gcp-batch-execute-as-via-default-sa
emits: CanExecuteAs
description: Create a job WITHOUT specifying a runtime SA -> runs as the Compute Engine default SA (usually
  roles/editor).
match:
- - principal: null
  - CanCreate
  - scope: null
- - job: null
  - ExecutesAs
  - defaultsa: null
where:
- ?principal has batch.jobs.create in ?scope
- ?principal has iam.serviceAccounts.actAs on ?defaultsa (required even for the default Compute Engine
  SA)
- ?defaultsa == the Compute Engine default SA of ?scope.project (PROJECT_NUMBER[email protected])
- ?defaultsa.privilege_level >= ?principal.privilege_level
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <Compute Engine default service account>
  permissions:
  - batch.jobs.create
  - iam.serviceAccounts.actAs
  conditions:
  - iam_permission
  state_logic: CONDITIONAL(iam_permission) by default -- creating a job with the default Compute Engine
    SA still requires iam.serviceAccounts.actAs on that default SA (per the Batch custom-service-account
    guide). ACTIVE only when the caller actually holds actAs on the default Compute Engine SA; otherwise
    POTENTIAL/CONDITIONAL(iam_permission).
  conditions_from:
  - defaultsa: null
  false_positive_note: 'Service Account User (iam.serviceAccounts.actAs) is required on the job''s service
    account -- including the default Compute Engine SA -- per the official Batch custom-service-account
    guide. Do NOT treat the omitted/default SA as an actAs-free shortcut: a principal with batch.jobs.create
    but WITHOUT actAs on the default Compute Engine SA cannot start the job. Default SA is usually roles/editor
    -> high value once actAs is confirmed.'
  narrative: '{principal.name} can create a Batch job without a custom SA (batch.jobs.create); its VMs
    run attacker code as the default Compute Engine SA {sa.name} (typically roles/editor).'