rage.fail

gcp-certmanager-cross-project-trust

explicit gcp emits CrossProjectTrust

match (record)

{ "field": "iamPolicy.bindings[].members", "resource_type": "google.privateca.CaPool" }

where

a member (user/SA/group) belongs to a different project than the CA pool the bound role grants certificateRequester / caPools.use / certificates.create

emit

source	`<capool.project>`
target	`<member.project \| external identity>`

Narrative

{capool.name} grants certificate issuance to {external.name} in project {project}, enabling cross-project cert forgery.

Raw rule rules/explicit/gcp-certmanager.yaml

id: gcp-certmanager-cross-project-trust
emits: CrossProjectTrust
applies_to:
- gcp
match_record:
  resource_type: google.privateca.CaPool
  field: iamPolicy.bindings[].members
where:
- a member (user/SA/group) belongs to a different project than the CA pool
- the bound role grants certificateRequester / caPools.use / certificates.create
emit:
  source: <capool.project>
  target: <member.project | external identity>
  api_source: privateca.projects.locations.caPools.getIamPolicy
  evidence_field: iamPolicy.bindings[].members / role
  narrative: '{capool.name} grants certificate issuance to {external.name} in project {project}, enabling
    cross-project cert forgery.'