gcp-bigtable-set-iam-policy-authorized-view

id: gcp-bigtable-set-iam-policy-authorized-view
emits: CanGrantPermission
description: bigtable.authorizedViews.setIamPolicy lets a principal grant view-scope roles to any principal
  (including itself). Self-granting bigtable.authorizedViews.readRows or bigtable.authorizedViews.mutateRows
  on a view yields data access scoped to that view's row/column subset without modifying table-level or
  instance-level IAM. View-scope setIamPolicy is a distinct, view-only escalation primitive.
match_effective_permission:
  action: bigtable.authorizedViews.setIamPolicy
  resource_type: google.bigtable.admin.v2.AuthorizedView
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <any principal (self-grant or other)>
  permissions:
  - bigtable.authorizedViews.setIamPolicy
  conditions:
  - iam_permission
  state_logic: 'ACTIVE when bigtable.authorizedViews.setIamPolicy is confirmed as an ACTIVE effective
    permission on the authorized view AND no deny policy or org policy blocks IAM mutations on Bigtable
    resources; CONDITIONAL(iam_permission) when the effective-permission evaluation is uncertain (e.g.,
    IAM Conditions expression partially unresolved); BLOCKED when a deny policy explicitly denies bigtable.authorizedViews.setIamPolicy
    at the view scope. Note: IAM calls are not blocked by VPC-SC perimeters on bigtable.googleapis.com
    (IAM uses a separate API path).'
  confidence: min(contributing_confidences) * 0.97
  derived_from:
  - bigtable.authorizedViews.setIamPolicy effective permission on AuthorizedView
  false_positive_note: "bigtable.authorizedViews.setIamPolicy is the view-scoped IAM mutation action.\
    \ It modifies the Cloud IAM policy at the authorized-view level only, enabling a self-grant of bigtable.authorizedViews.readRows\
    \ or bigtable.authorizedViews.mutateRows on the view without modifying table-level or instance-level\
    \ IAM. This is a distinct escalation from bigtable.tables.setIamPolicy (table-scope) and bigtable.instances.setIamPolicy\
    \ (instance-scope). Emit separate CanGrantPermission edges for each scope: view-scope setIamPolicy\
    \ targets the view, table-scope targets the table, instance-scope targets the instance. The self-grant\
    \ path is: setIamPolicy \u2192 grant bigtable.authorizedViews.readRows/mutateRows \u2192 CanReadData/\
    \ CanWriteData on the view only (NOT the parent table). Authorized-view IAM does NOT cascade to the\
    \ parent table or instance."
  narrative: '{principal.name} holds bigtable.authorizedViews.setIamPolicy on authorized view {view.name}
    and can grant itself or any principal bigtable.authorizedViews.readRows or bigtable.authorizedViews.mutateRows,
    gaining data access scoped to {view.name}''s row/column subset without modifying table or instance
    IAM.'