gcp-bigtable-set-iam-policy-instance

id: gcp-bigtable-set-iam-policy-instance
emits: CanGrantPermission
description: bigtable.instances.setIamPolicy lets a principal grant instance-scope roles to any principal
  (including itself). Self-granting roles/bigtable.admin on the instance yields full control over all
  tables, clusters, and backups within the instance without project-level IAM change. Instance-scope setIamPolicy
  is a higher-value escalation than table-scope because it affects all tables.
match_effective_permission:
  action: bigtable.instances.setIamPolicy
  resource_type: google.bigtable.admin.v2.Instance
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <any principal (self-grant or other)>
  permissions:
  - bigtable.instances.setIamPolicy
  conditions:
  - iam_permission
  state_logic: 'ACTIVE when bigtable.instances.setIamPolicy is confirmed as an ACTIVE effective permission
    on the instance scope AND no deny policy or org policy blocks IAM mutations on Bigtable resources;
    CONDITIONAL(iam_permission) when the effective-permission evaluation is uncertain (e.g., IAM Conditions
    expression partially unresolved); BLOCKED when a deny policy explicitly denies bigtable.instances.setIamPolicy
    at the instance scope. Note: IAM calls are not blocked by VPC-SC perimeters on bigtable.googleapis.com
    (IAM uses a separate API path).'
  confidence: min(contributing_confidences) * 0.97
  derived_from:
  - bigtable.instances.setIamPolicy effective permission on Instance
  false_positive_note: "bigtable.instances.setIamPolicy is the instance-scope IAM mutation action. It\
    \ modifies the Cloud IAM policy at the instance level, enabling a self-grant of roles/bigtable.admin\
    \ (or any role) on the instance, which cascades to all tables, clusters, and authorized views in the\
    \ instance. This is a higher-value escalation than bigtable.tables.setIamPolicy (table-scope only).\
    \ Emit a separate CanGrantPermission edge for each scope: table-scope setIamPolicy targets the table,\
    \ instance-scope targets the instance. The self-grant path is: setIamPolicy \u2192 grant roles/bigtable.admin\
    \ \u2192 CanAdminister on instance \u2192 all tables in scope. Chains to CanReadData(principal, all\
    \ tables) via the self-bound roles/bigtable.admin."
  narrative: '{principal.name} holds bigtable.instances.setIamPolicy on instance {instance.name} and can
    grant itself or any principal roles/bigtable.admin, gaining full control over all tables, clusters,
    and backups in {instance.name} without modifying project-level IAM. This is a wider escalation than
    table-scope setIamPolicy.'