rage.fail

gcp-certmanager-can-modify-ca-state

explicit gcp emits CanModifyConfiguration

match (effective permission)

{ "action": "privateca.certificateAuthorities.update", "resource_type": "google.privateca.CertificateAuthority" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<CertificateAuthority node>`
permissions	`privateca.certificateAuthorities.update`

Narrative

{principal.name} can change configuration/state of CA {ca.name} (privateca.certificateAuthorities.update), e.g. re-enable a disabled CA to restore issuance.

Raw rule rules/explicit/gcp-certmanager.yaml

id: gcp-certmanager-can-modify-ca-state
emits: CanModifyConfiguration
applies_to:
- gcp
match_effective_permission:
  action: privateca.certificateAuthorities.update
  resource_type: google.privateca.CertificateAuthority
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <CertificateAuthority node>
  permissions:
  - privateca.certificateAuthorities.update
  narrative: '{principal.name} can change configuration/state of CA {ca.name} (privateca.certificateAuthorities.update),
    e.g. re-enable a disabled CA to restore issuance.'