rage.fail

gcp-certmanager-issuance-policy-ref

explicit gcp emits ContainsResourceReference

match (record)

{ "field": "issuancePolicy", "resource_type": "google.privateca.CaPool" }

where

record identityConstraints.allowSubjectPassthrough / allowSubjectAltNamesPassthrough / celExpression / allowedIssuanceModes / allowedKeyTypes and any bound certificate template

emit

target type	`*`
source	`<CA pool node>`
target	`<issuancePolicy evidence node>`

Narrative

{capool.name} issuance policy defines whether a requester may set an arbitrary subject/SAN (forgery gate for gcp-certmanager-impersonate-via-forged-cert).

Raw rule rules/explicit/gcp-certmanager.yaml

id: gcp-certmanager-issuance-policy-ref
emits: ContainsResourceReference
applies_to:
- gcp
match_record:
  resource_type: google.privateca.CaPool
  field: issuancePolicy
where:
- record identityConstraints.allowSubjectPassthrough / allowSubjectAltNamesPassthrough / celExpression
  / allowedIssuanceModes / allowedKeyTypes and any bound certificate template
emit:
  target_type: '*'
  source: <CA pool node>
  target: <issuancePolicy evidence node>
  api_source: privateca.projects.locations.caPools.get
  evidence_field: issuancePolicy.identityConstraints / baselineValues / allowedIssuanceModes
  narrative: '{capool.name} issuance policy defines whether a requester may set an arbitrary subject/SAN
    (forgery gate for gcp-certmanager-impersonate-via-forged-cert).'