gcp-certmanager-set-iam-self-grant
caPools.setIamPolicy lets a caller bind itself certificateRequester and then issue.
match (effective permission)
{
"action": "privateca.caPools.setIamPolicy",
"resource_type": "google.privateca.CaPool"
}
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <principal (self)> |
| permissions | privateca.caPools.setIamPolicy |
| conditions | iam_permission |
| state logic | ACTIVE if caPools.setIamPolicy resolves on the pool; BLOCKED under an IAM deny / org policy / VPC-SC perimeter denying it. Chains to CanSignAs via a self-bound roles/privateca.certificateRequester (which bundles certificates.create + caPools.use). |
Narrative
{principal.name} can set the IAM policy of CA pool {capool.name} (privateca.caPools.setIamPolicy) and grant itself certificateRequester, then issue certificates.
Raw rule rules/derived/gcp/certmanager.yaml
id: gcp-certmanager-set-iam-self-grant
emits: CanGrantPermission
description: caPools.setIamPolicy lets a caller bind itself certificateRequester and then issue.
match_effective_permission:
action: privateca.caPools.setIamPolicy
resource_type: google.privateca.CaPool
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <principal (self)>
permissions:
- privateca.caPools.setIamPolicy
conditions:
- iam_permission
state_logic: ACTIVE if caPools.setIamPolicy resolves on the pool; BLOCKED under an IAM deny / org policy
/ VPC-SC perimeter denying it. Chains to CanSignAs via a self-bound roles/privateca.certificateRequester
(which bundles certificates.create + caPools.use).
confidence: min(contributing_confidences) * 0.95
derived_from:
- <effective privateca.caPools.setIamPolicy grant>
false_positive_note: 'Escalation primitive: the caller can add a binding granting itself roles/privateca.certificateRequester
(or admin) on the pool, then issue. The subsequent forgery is still gated by the pool issuancePolicy;
the KMS gate still applies to KMS-backed CAs. setIamPolicy is per-pool unless held at an ancestor.'
narrative: '{principal.name} can set the IAM policy of CA pool {capool.name} (privateca.caPools.setIamPolicy)
and grant itself certificateRequester, then issue certificates.'