gcp-certmanager-public-requester
A CA-pool binding granting requester/use to allUsers/allAuthenticatedUsers exposes issuance broadly.
match (record)
{
"field": "iamPolicy.bindings",
"resource_type": "google.privateca.CaPool"
}
where
a binding on the pool (or inherited) grants roles/privateca.certificateRequester, roles/privateca.certificateManager, or privateca.caPools.use + privateca.certificates.create to allUsers or allAuthenticatedUsers
emit
| source type | * |
|---|---|
| source | <CA pool> |
| target | <Tenant/Organization> |
| permissions | privateca.certificates.create privateca.caPools.use |
| conditions | resource_policy |
| state logic | ACTIVE if the wildcard binding is present and not overridden by an IAM deny / org policy / VPC-SC perimeter; else BLOCKED. Downstream forgery/impersonation still gated by the issuance policy + trust consumer. |
Narrative
CA pool {capool.name} grants certificate issuance to any Google-authenticated principal (allUsers/allAuthenticatedUsers bound to roles/privateca.certificateRequester) - tenant-wide cert forgery exposure.
Raw rule rules/derived/gcp/certmanager.yaml
id: gcp-certmanager-public-requester
emits: ExposedToTenant
description: A CA-pool binding granting requester/use to allUsers/allAuthenticatedUsers exposes issuance
broadly.
match_record:
resource_type: google.privateca.CaPool
field: iamPolicy.bindings
where:
- a binding on the pool (or inherited) grants roles/privateca.certificateRequester, roles/privateca.certificateManager,
or privateca.caPools.use + privateca.certificates.create to allUsers or allAuthenticatedUsers
emit:
source_type: '*'
source: <CA pool>
target: <Tenant/Organization>
permissions:
- privateca.certificates.create
- privateca.caPools.use
conditions:
- resource_policy
state_logic: ACTIVE if the wildcard binding is present and not overridden by an IAM deny / org policy
/ VPC-SC perimeter; else BLOCKED. Downstream forgery/impersonation still gated by the issuance policy
+ trust consumer.
confidence: '0.9'
derived_from:
- <CA pool iamPolicy binding to allUsers/allAuthenticatedUsers>
false_positive_note: "allAuthenticatedUsers = any Google account (tenant/org-wide), NOT anonymous internet\
\ \u2014 CAS has no anonymous data plane, so model as ExposedToTenant, never ExposedToInternet. A\
\ DOMAIN_RESTRICTED_SHARING org policy or a VPC-SC perimeter can neutralize allUsers/allAuthenticatedUsers\
\ -> BLOCKED. Broad issuance is only as dangerous as the pool's issuance policy and the trusts that\
\ consume its certs."
narrative: "CA pool {capool.name} grants certificate issuance to any Google-authenticated principal\
\ (allUsers/allAuthenticatedUsers bound to roles/privateca.certificateRequester) \u2014 tenant-wide\
\ cert forgery exposure."