gcp-bigquery-explicit-can-grant-permission
bigquery.datasets.setIamPolicy lets a principal grant data access to any principal (including itself) for all tables in the dataset.
match (effective permission)
{
"action": "bigquery.datasets.setIamPolicy",
"resource_type": "google.bigquery.Dataset"
}
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <any principal> |
| permissions | bigquery.datasets.setIamPolicy |
| conditions | iam_permission |
| state logic | ACTIVE when bigquery.datasets.setIamPolicy is confirmed at the dataset or project scope and no org policy or VPC-SC perimeter blocks IAM mutations; CONDITIONAL(scp_or_org_policy) if an org policy restricts setIamPolicy calls. |
Narrative
{principal.name} holds bigquery.datasets.setIamPolicy on {dataset.name} and can grant itself or any principal full data access (e.g. roles/bigquery.dataViewer or roles/bigquery.dataOwner), reading all tables in the dataset.
Raw rule rules/explicit/gcp/bigquery.yaml
id: gcp-bigquery-explicit-can-grant-permission
emits: CanGrantPermission
description: bigquery.datasets.setIamPolicy lets a principal grant data access to any principal (including
itself) for all tables in the dataset.
match_effective_permission:
action: bigquery.datasets.setIamPolicy
resource_type: google.bigquery.Dataset
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <any principal>
permissions:
- bigquery.datasets.setIamPolicy
conditions:
- iam_permission
state_logic: ACTIVE when bigquery.datasets.setIamPolicy is confirmed at the dataset or project scope
and no org policy or VPC-SC perimeter blocks IAM mutations; CONDITIONAL(scp_or_org_policy) if an org
policy restricts setIamPolicy calls.
false_positive_note: 'bigquery.datasets.setIamPolicy is present in roles/bigquery.admin (project-scope)
and roles/bigquery.dataOwner (dataset-scope). It allows modifying the Cloud IAM policy on the dataset
resource. Note: dataset ACL entries (the access[] array) are modified via bigquery.datasets.update,
NOT setIamPolicy; they represent the BigQuery-native ACL layer. setIamPolicy governs the resource-level
Cloud IAM policy. Both layers must be distinguished in the permission evaluator. Org policy iam.disableServiceAccountKeyCreation
does NOT block setIamPolicy; a project-scope deny policy on resourcemanager.*setIamPolicy WOULD block
it.'
narrative: '{principal.name} holds bigquery.datasets.setIamPolicy on {dataset.name} and can grant itself
or any principal full data access (e.g. roles/bigquery.dataViewer or roles/bigquery.dataOwner), reading
all tables in the dataset.'
derived_from:
- bigquery.datasets.setIamPolicy effective permission on Dataset
api_source: Cloud Asset Inventory analyzeIamPolicy
evidence_field: bigquery.datasets.setIamPolicy effective permission