rage.fail

gcp-certmanager-can-modify-configuration

explicit gcp emits CanModifyConfiguration

match (effective permission)

{ "action": "privateca.caPools.update", "resource_type": "google.privateca.CaPool" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<CA pool node>`
permissions	`privateca.caPools.update` `privateca.certificateTemplates.update`

Narrative

{principal.name} can update the issuance policy/config of CA pool {capool.name} (privateca.caPools.update), e.g. loosen identity constraints to permit arbitrary-subject forgery.

Raw rule rules/explicit/gcp-certmanager.yaml

id: gcp-certmanager-can-modify-configuration
emits: CanModifyConfiguration
applies_to:
- gcp
match_effective_permission:
  action: privateca.caPools.update
  resource_type: google.privateca.CaPool
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <CA pool node>
  permissions:
  - privateca.caPools.update
  - privateca.certificateTemplates.update
  narrative: '{principal.name} can update the issuance policy/config of CA pool {capool.name} (privateca.caPools.update),
    e.g. loosen identity constraints to permit arbitrary-subject forgery.'