gcp-certmanager-loosen-issuance-policy
caPools.update rewrites the issuance policy / identity constraints, enabling arbitrary-subject forgery.
match (effective permission)
{
"action": "privateca.caPools.update",
"resource_type": "google.privateca.CaPool"
}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <CA pool node> |
| permissions | privateca.caPools.update |
| conditions | iam_permission |
| state logic | ACTIVE for the config-write capability if caPools.update resolves; BLOCKED under IAM/org/VPC-SC deny. Its escalation VALUE is realized only when combined with an issuance path: setting identityConstraints.allowSubjectPassthrough / allowSubjectAltNamesPassthrough true (or a permissive celExpression) lifts a constrained CanSignAs to arbitrary-subject forgery. |
Narrative
{principal.name} can update the issuance policy of CA pool {capool.name} (privateca.caPools.update), loosening identity constraints to permit arbitrary-subject certificate forgery.
Raw rule rules/derived/gcp/certmanager.yaml
id: gcp-certmanager-loosen-issuance-policy
emits: CanModifyConfiguration
description: caPools.update rewrites the issuance policy / identity constraints, enabling arbitrary-subject
forgery.
match_effective_permission:
action: privateca.caPools.update
resource_type: google.privateca.CaPool
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <CA pool node>
permissions:
- privateca.caPools.update
conditions:
- iam_permission
state_logic: 'ACTIVE for the config-write capability if caPools.update resolves; BLOCKED under IAM/org/VPC-SC
deny. Its escalation VALUE is realized only when combined with an issuance path: setting identityConstraints.allowSubjectPassthrough
/ allowSubjectAltNamesPassthrough true (or a permissive celExpression) lifts a constrained CanSignAs
to arbitrary-subject forgery.'
confidence: min(contributing_confidences) * 0.9
derived_from:
- <effective privateca.caPools.update grant>
false_positive_note: Config-write, not issuance by itself. Only becomes forgery when the caller also
has (or can self-grant) certificates.create + caPools.use. privateca.certificate Templates.update
is the equivalent write against a bound template. Not escalation on its own. privateca.certificateAuthorities.update
(re-enable a DISABLED CA) is a related config change that restores a BLOCKED issuance path.
narrative: '{principal.name} can update the issuance policy of CA pool {capool.name} (privateca.caPools.update),
loosening identity constraints to permit arbitrary-subject certificate forgery.'