gcp-certmanager-set-iam-policy
caPools.setIamPolicy writes the pool's IAM allow policy (grant self/others any access).
match (effective permission)
{
"action": "privateca.caPools.setIamPolicy",
"resource_type": "google.privateca.CaPool"
}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <CA pool allow policy in scope> |
| permissions | privateca.caPools.setIamPolicy |
| conditions | iam_permission |
| state logic | ACTIVE if setIamPolicy resolves; BLOCKED under IAM/org/VPC-SC deny. |
Narrative
{principal.name} can modify the IAM allow policy of CA pool {capool.name} (privateca.caPools.setIamPolicy).
Raw rule rules/derived/gcp/certmanager.yaml
id: gcp-certmanager-set-iam-policy
emits: CanModifyPolicy
description: caPools.setIamPolicy writes the pool's IAM allow policy (grant self/others any access).
match_effective_permission:
action: privateca.caPools.setIamPolicy
resource_type: google.privateca.CaPool
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <CA pool allow policy in scope>
permissions:
- privateca.caPools.setIamPolicy
conditions:
- iam_permission
state_logic: ACTIVE if setIamPolicy resolves; BLOCKED under IAM/org/VPC-SC deny.
confidence: min(contributing_confidences) * 0.97
derived_from:
- <effective privateca.caPools.setIamPolicy grant>
false_positive_note: Overlaps gcp-certmanager-set-iam-self-grant (the escalation roll-up); this records
the raw policy-write capability on the pool's ResourcePolicy. De-dupe on edge_id if both are consumed.
narrative: '{principal.name} can modify the IAM allow policy of CA pool {capool.name} (privateca.caPools.setIamPolicy).'