gcp-bigquery-explicit-can-modify-policy-dataset-acl

id: gcp-bigquery-explicit-can-modify-policy-dataset-acl
emits: CanModifyPolicy
description: bigquery.datasets.update lets a principal modify the dataset-native ACL (access[] entries),
  including adding authorized views and broad access entries.
match_effective_permission:
  action: bigquery.datasets.update
  resource_type: google.bigquery.Dataset
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <Dataset ResourcePolicy node>
  permissions:
  - bigquery.datasets.update
  conditions:
  - iam_permission
  state_logic: ACTIVE when bigquery.datasets.update is confirmed at the dataset or project scope; CONDITIONAL(iam_permission)
    when inherited only via a project-level role that may be scoped away by VPC-SC.
  false_positive_note: "bigquery.datasets.update modifies the dataset-native access[] ACL entries (READER/WRITER/OWNER\
    \ semantic roles, authorized views, authorized datasets, domain-level grants). This is DISTINCT from\
    \ bigquery.datasets.setIamPolicy which governs the Cloud IAM resource policy layer. An attacker with\
    \ bigquery.datasets.update can add allUsers (public), allAuthenticatedUsers (any Google user), or\
    \ a cross-project SA \u2014 these produce ExposedToInternet, ExposedToTenant, and CrossProjectTrust\
    \ edges respectively (see explicit normalization rules). This edge fires the CanModifyPolicy; the\
    \ downstream exposure edges are explicit."
  narrative: '{principal.name} can modify the BigQuery-native ACL of {dataset.name} (bigquery.datasets.update),
    adding access entries including allUsers, allAuthenticatedUsers, or cross-project service accounts.'
  derived_from:
  - bigquery.datasets.update effective permission on Dataset
  api_source: Cloud Asset Inventory analyzeIamPolicy
  evidence_field: bigquery.datasets.update effective permission