rage.fail

gcp-batch-exposes-runtime-sa

Code running in the job VM reads the runtime SA token from the GCE metadata server.

derived gcp emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteAs {'sa': None}

emit

source	`<batch job>`
target	`<runtime service account>`

Narrative

{job.name} exposes credentials for {sa.name} to any code it runs (GCE metadata server token endpoint).

Raw rule rules/derived/gcp/batch.yaml

id: gcp-batch-exposes-runtime-sa
emits: ExposesCredential
description: Code running in the job VM reads the runtime SA token from the GCE metadata server.
match:
- - principal: null
  - CanExecuteAs
  - sa: null
emit:
  source: <batch job>
  target: <runtime service account>
  permissions: []
  note: 'Metadata endpoint: http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
    (header Metadata-Flavor: Google).'
  narrative: '{job.name} exposes credentials for {sa.name} to any code it runs (GCE metadata server token
    endpoint).'