rage.fail

gcp-certmanager-can-read-certificate

explicit gcp emits CanRead

match (effective permission)

{ "action": "privateca.certificates.get", "resource_type": "google.privateca.Certificate" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<CA pool / certificate node>`
permissions	`privateca.certificates.get` `privateca.certificates.list`

Narrative

{principal.name} can retrieve certificates issued by {capool.name} (privateca.certificates.get/list - public cert material, not the CA private key).

Raw rule rules/explicit/gcp-certmanager.yaml

id: gcp-certmanager-can-read-certificate
emits: CanRead
applies_to:
- gcp
match_effective_permission:
  action: privateca.certificates.get
  resource_type: google.privateca.Certificate
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <CA pool / certificate node>
  permissions:
  - privateca.certificates.get
  - privateca.certificates.list
  narrative: "{principal.name} can retrieve certificates issued by {capool.name} (privateca.certificates.get/list\
    \ \u2014 public cert material, not the CA private key)."