gcp-bigtable-write-data

id: gcp-bigtable-write-data
emits: CanWriteData
description: bigtable.tables.mutateRows grants the caller the ability to write, update, and delete rows
  in a Bigtable table. This is included in roles/bigtable.user and above. Data mutation enables credential
  injection, configuration poisoning, and application state corruption.
match_effective_permission:
  action: bigtable.tables.mutateRows
  resource_type: google.bigtable.admin.v2.Table
where:
- instance.state EQUALS READY
- cluster.encryptionConfig.kmsKeyName EQUALS NULL
emit:
  source_type: Identity
  target_type: NoSQLDatabase
  source: <principal>
  target: <Bigtable Table / NoSQLDatabase node>
  permissions:
  - bigtable.tables.mutateRows
  conditions:
  - iam_permission
  - resource_policy
  state_logic: ACTIVE when bigtable.tables.mutateRows is confirmed ACTIVE effective permission on the
    table AND the instance state is READY AND no VPC-SC perimeter blocks bigtable.googleapis.com for the
    caller's context; CONDITIONAL(resource_policy) when the effective-permission evaluator can only confirm
    project-scope binding that may be capped by IAM Conditions; BLOCKED when a VPC-SC perimeter enforces
    or a deny policy denies mutateRows.
  confidence: min(contributing_confidences) * 0.97
  derived_from:
  - bigtable.tables.mutateRows effective permission on Table
  false_positive_note: bigtable.tables.mutateRows is the write-plane permission controlling row mutations.
    Do not conflate with bigtable.authorizedViews.mutateRows (view-scoped only). roles/bigtable.user includes
    both readRows and mutateRows, making users dangerous if the table contains credentials or configuration.
    For CMEK tables, apply CMEK-write variant logic (service agent's KMS key must be ENABLED). See gcp-bigtable-write-data-cmek
    for CMEK treatment.
  narrative: '{principal.name} holds bigtable.tables.mutateRows on table {table.name}; it can write, update,
    and delete rows, poisoning data or injecting credentials stored in the table.'