rage.fail

gcp-batch-retrieve-runtime-sa-token

Attacker with execution in the job can mint the runtime SA token.

derived gcp emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteAs {'sa': None}

emit

source	`<principal>`
target	`<runtime service account>`

Narrative

{principal.name}, executing in a Batch job, can retrieve an access token for {sa.name} from the metadata server.

Raw rule rules/derived/gcp/batch.yaml

id: gcp-batch-retrieve-runtime-sa-token
emits: CanRetrieveToken
description: Attacker with execution in the job can mint the runtime SA token.
match:
- - principal: null
  - CanExecuteAs
  - sa: null
emit:
  source: <principal>
  target: <runtime service account>
  permissions: []
  narrative: '{principal.name}, executing in a Batch job, can retrieve an access token for {sa.name} from
    the metadata server.'