rage.fail

gcp-certmanager-can-administer

explicit gcp emits CanAdminister

match (effective permission)

{ "action": "privateca.*", "resource_type": "google.privateca.CaPool" }

where

principal holds roles/privateca.admin or equivalent full privateca.* on the pool scope

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<CA pool node>`
permissions	`privateca.*`

Narrative

{principal.name} has full administrative control over CA pool {capool.name} (roles/privateca.admin / privateca.*).

Raw rule rules/explicit/gcp-certmanager.yaml

id: gcp-certmanager-can-administer
emits: CanAdminister
applies_to:
- gcp
match_effective_permission:
  action: privateca.*
  resource_type: google.privateca.CaPool
where:
- principal holds roles/privateca.admin or equivalent full privateca.* on the pool scope
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <CA pool node>
  permissions:
  - privateca.*
  narrative: '{principal.name} has full administrative control over CA pool {capool.name} (roles/privateca.admin
    / privateca.*).'