rage.fail

gcp-certmanager-can-modify-policy

explicit gcp emits CanModifyPolicy

match (effective permission)

{ "action": "privateca.caPools.setIamPolicy", "resource_type": "google.privateca.CaPool" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<CA pool allow policy node>`
permissions	`privateca.caPools.setIamPolicy`

Narrative

{principal.name} can rewrite the IAM allow policy of CA pool {capool.name} (privateca.caPools.setIamPolicy) to grant itself/others issuance.

Raw rule rules/explicit/gcp-certmanager.yaml

id: gcp-certmanager-can-modify-policy
emits: CanModifyPolicy
applies_to:
- gcp
match_effective_permission:
  action: privateca.caPools.setIamPolicy
  resource_type: google.privateca.CaPool
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <CA pool allow policy node>
  permissions:
  - privateca.caPools.setIamPolicy
  narrative: '{principal.name} can rewrite the IAM allow policy of CA pool {capool.name} (privateca.caPools.setIamPolicy)
    to grant itself/others issuance.'