gcp-certmanager-cross-project-forge

A cross-project requester forging a cert a privileged consumer in the CA's project trusts enters that project.

derived gcp emits CanEnterProject

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Project`
source	`<principal>`
target	`<capool.project>`
permissions	`privateca.certificates.create` `privateca.caPools.use`
conditions	`iam_permission` `condition_expression` `trust_relationship`
state logic	Inherits the CanImpersonate state (already double-gated on issuance policy + trust). ACTIVE only when the cross-project issuance resolves, the subject is forgeable, a consuming trust exists, AND the forged identity is privileged in the CA's project; CONDITIONAL otherwise; BLOCKED if the CanImpersonate input is BLOCKED.

source type

Identity

target type

Project

source

<principal>

target

<capool.project>

permissions

privateca.certificates.create privateca.caPools.use

conditions

iam_permission condition_expression trust_relationship

state logic

Inherits the CanImpersonate state (already double-gated on issuance policy + trust). ACTIVE only when the cross-project issuance resolves, the subject is forgeable, a consuming trust exists, AND the forged identity is privileged in the CA's project; CONDITIONAL otherwise; BLOCKED if the CanImpersonate input is BLOCKED.

Narrative

{principal.name} (project {principal.project}) can issue a cert from CA pool {capool.name} in project {capool.project} impersonating {target.name}, which is privileged there - entering project {capool.project}.

Raw rule rules/derived/gcp/certmanager.yaml

id: gcp-certmanager-cross-project-forge
emits: CanEnterProject
description: A cross-project requester forging a cert a privileged consumer in the CA's project trusts
  enters that project.
match:
- - principal: null
  - CanImpersonate
  - target: null
where:
- ?principal.project != ?capool.project (the CanImpersonate was derived from a CanSignAs on a pool in
  another project)
- ?target has bindings granting privilege in ?capool.project (the forged identity is privileged in the
  CA's project)
emit:
  source_type: Identity
  target_type: Project
  source: <principal>
  target: <capool.project>
  permissions:
  - privateca.certificates.create
  - privateca.caPools.use
  conditions:
  - iam_permission
  - condition_expression
  - trust_relationship
  state_logic: Inherits the CanImpersonate state (already double-gated on issuance policy + trust). ACTIVE
    only when the cross-project issuance resolves, the subject is forgeable, a consuming trust exists,
    AND the forged identity is privileged in the CA's project; CONDITIONAL otherwise; BLOCKED if the CanImpersonate
    input is BLOCKED.
  confidence: min(contributing_confidences) * 0.85
  derived_from:
  - <CanImpersonate edge_id>
  - <cross-project pool binding>
  - <forged-identity privilege in capool.project>
  false_positive_note: "Only cross-boundary when principal and CA pool live in different projects AND\
    \ the forgeable identity is privileged in the pool's project AND a consumer there trusts the CA. A\
    \ cross-project certificateRequester binding is the common enabler; honor its condition expressions.\
    \ Inherits the issuance-policy and trust gates \u2014 do not upgrade to ACTIVE while either is unconfirmed."
  narrative: "{principal.name} (project {principal.project}) can issue a cert from CA pool {capool.name}\
    \ in project {capool.project} impersonating {target.name}, which is privileged there \u2014 entering\
    \ project {capool.project}."