gcp-bigtable-write-data-cmek
bigtable.tables.mutateRows on a CMEK-encrypted cluster; the Bigtable service agent decrypts via Cloud KMS before allowing writes - CanWriteData is CONDITIONAL(key_permission) on the service agent's KMS grant.
match (effective permission)
{
"action": "bigtable.tables.mutateRows",
"resource_type": "google.bigtable.admin.v2.Table"
}
where
cluster.encryptionConfig.kmsKeyName NOT_EQUALS NULL
emit
| source type | Identity |
|---|---|
| target type | NoSQLDatabase |
| source | <principal> |
| target | <CMEK Bigtable Table / NoSQLDatabase node> |
| permissions | bigtable.tables.mutateRows |
| conditions | iam_permission resource_policy key_permission |
| state logic | ACTIVE if the Bigtable service agent holds cloudkms.cryptoKeyVersions.useToEncryptDecrypt on the cluster's encryptionConfig.kmsKeyName AND the key version is ENABLED; CONDITIONAL(key_permission) if the service-agent grant or key state is unknown; BLOCKED if the service agent lacks the grant OR the key is DISABLED/DESTROYED (both reads and writes become inaccessible; the cluster enters ERROR state regardless of the caller's IAM). |
Narrative
{principal.name} holds bigtable.tables.mutateRows on CMEK table {table.name} in cluster {cluster.name}; writes are gated on the Bigtable service agent's cloudkms.cryptoKeyEncrypterDecrypter grant on {key.name}.
Raw rule rules/derived/gcp/bigtable.yaml
id: gcp-bigtable-write-data-cmek
emits: CanWriteData
description: "bigtable.tables.mutateRows on a CMEK-encrypted cluster; the Bigtable service agent decrypts\
\ via Cloud KMS before allowing writes \u2014 CanWriteData is CONDITIONAL(key_permission) on the service\
\ agent's KMS grant."
match_effective_permission:
action: bigtable.tables.mutateRows
resource_type: google.bigtable.admin.v2.Table
where:
- cluster.encryptionConfig.kmsKeyName NOT_EQUALS NULL
emit:
source_type: Identity
target_type: NoSQLDatabase
source: <principal>
target: <CMEK Bigtable Table / NoSQLDatabase node>
permissions:
- bigtable.tables.mutateRows
conditions:
- iam_permission
- resource_policy
- key_permission
state_logic: ACTIVE if the Bigtable service agent holds cloudkms.cryptoKeyVersions.useToEncryptDecrypt
on the cluster's encryptionConfig.kmsKeyName AND the key version is ENABLED; CONDITIONAL(key_permission)
if the service-agent grant or key state is unknown; BLOCKED if the service agent lacks the grant OR
the key is DISABLED/DESTROYED (both reads and writes become inaccessible; the cluster enters ERROR
state regardless of the caller's IAM).
confidence: min(contributing_confidences) * 0.95
derived_from:
- bigtable.tables.mutateRows effective permission on CMEK Table
- Bigtable service-agent KMS binding on cluster.encryptionConfig.kmsKeyName
false_positive_note: The key_permission gate is on the BIGTABLE SERVICE AGENT, not the caller. A caller
with mutateRows can write to CMEK data while the service agent holds useToEncryptDecrypt. Downgrade
to CONDITIONAL/BLOCKED only based on the service agent's KMS grant state and key status, never on
caller KMS permissions.
narrative: '{principal.name} holds bigtable.tables.mutateRows on CMEK table {table.name} in cluster
{cluster.name}; writes are gated on the Bigtable service agent''s cloudkms.cryptoKeyEncrypterDecrypter
grant on {key.name}.'