gcp-bigtable-write-authorized-view

id: gcp-bigtable-write-authorized-view
emits: CanWriteData
description: bigtable.authorizedViews.mutateRows grants write access to a scoped subset of a table (row
  key prefix / column qualifier filtering). The caller can only write rows within the authorized view's
  defined scope; write access to the parent table is NOT granted. CanWriteData is scoped to the AuthorizedView
  node.
match_effective_permission:
  action: bigtable.authorizedViews.mutateRows
  resource_type: google.bigtable.admin.v2.AuthorizedView
where:
- instance.state EQUALS READY
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: <principal>
  target: <Authorized View / NoSQLDatabase node>
  permissions:
  - bigtable.authorizedViews.mutateRows
  conditions:
  - iam_permission
  - resource_policy
  state_logic: ACTIVE when bigtable.authorizedViews.mutateRows is confirmed ACTIVE effective permission
    on the authorized view AND the instance state is READY AND no VPC-SC perimeter blocks bigtable.googleapis.com
    for the caller's context; CONDITIONAL(resource_policy) when the effective-permission evaluator can
    only confirm project-scope binding that may be capped by IAM Conditions; BLOCKED when a VPC-SC perimeter
    enforces or a deny policy denies the permission.
  confidence: min(contributing_confidences) * 0.96
  derived_from:
  - bigtable.authorizedViews.mutateRows effective permission on AuthorizedView
  false_positive_note: 'IMPORTANT: A principal with bigtable.authorizedViews.mutateRows on a VIEW does
    NOT have write access to the parent table. Authorized views implement row/column scoping at the IAM
    level; the view''s write permission is scoped to its subset. Do NOT conflate with bigtable.tables.mutateRows
    (table-level write). View write and table write are separate, non-escalating capabilities. An attacker
    must hold bigtable.tables.mutateRows on the table itself to write beyond the view''s scope. Authorization
    boundaries are strictly enforced by the Bigtable API.'
  narrative: '{principal.name} holds bigtable.authorizedViews.mutateRows on authorized view {view.name}
    of table {table.name}; it can write, update, and delete rows within the view''s row-key prefix and
    column-qualifier scope only, not the full table.'