gcp-bigquery-explicit-can-modify-code-scheduled-query
bigquery.transfers.update lets a principal change a scheduled query's SQL - the code the Transfer Service runs as the attached SA.
match (effective permission)
{
"action": "bigquery.transfers.update",
"resource_type": "google.bigquery.datatransfer.TransferConfig"
}
emit
| source type | Identity |
|---|---|
| target type | Messaging |
| source | <principal> |
| target | <TransferConfig Scheduler node> |
| permissions | bigquery.transfers.update |
| conditions | iam_permission |
| state logic | ACTIVE when bigquery.transfers.update is confirmed on the TransferConfig scope; CONDITIONAL(iam_permission) when the permission is inherited only at project scope but a VPC-SC perimeter limits the DTS API. |
Narrative
{principal.name} can update the SQL of scheduled query {transferconfig.name} (bigquery.transfers.update), modifying what it executes as the attached service account. The cicd-chains linchpin (cicd-modify-buildspec-executes-as) rolls this CanModifyCode + ExecutesAs up to CanExecuteAs(principal, SA).
Raw rule rules/explicit/gcp/bigquery.yaml
id: gcp-bigquery-explicit-can-modify-code-scheduled-query
emits: CanModifyCode
description: "bigquery.transfers.update lets a principal change a scheduled query's SQL \u2014 the code\
\ the Transfer Service runs as the attached SA."
match_effective_permission:
action: bigquery.transfers.update
resource_type: google.bigquery.datatransfer.TransferConfig
emit:
source_type: Identity
target_type: Messaging
source: <principal>
target: <TransferConfig Scheduler node>
permissions:
- bigquery.transfers.update
conditions:
- iam_permission
state_logic: ACTIVE when bigquery.transfers.update is confirmed on the TransferConfig scope; CONDITIONAL(iam_permission)
when the permission is inherited only at project scope but a VPC-SC perimeter limits the DTS API.
false_positive_note: "bigquery.transfers.update allows modifying the query SQL AND the scheduled trigger,\
\ NOT the serviceAccountName alone (that additionally requires iam.serviceAccounts.actAs on the target\
\ SA). Modifying the SQL of a scheduled query that runs as the CREATING USER (no serviceAccountName\
\ set) does not yield SA credentials \u2014 emit CanModifyCode only; the ExecutesAs target is the\
\ creating user, not a service account. The data-plane impact of injected SQL is the SA's (or user's)\
\ own IAM grants \u2014 the attacker does not get a raw token, only effective data reach via server-side\
\ execution."
narrative: '{principal.name} can update the SQL of scheduled query {transferconfig.name} (bigquery.transfers.update),
modifying what it executes as the attached service account. The cicd-chains linchpin (cicd-modify-buildspec-executes-as)
rolls this CanModifyCode + ExecutesAs up to CanExecuteAs(principal, SA).'
derived_from:
- bigquery.transfers.update effective permission on TransferConfig
api_source: Cloud Asset Inventory analyzeIamPolicy
evidence_field: bigquery.transfers.update effective permission