gcp-ci-admin-reset-credential

id: gcp-ci-admin-reset-credential
emits: CanResetCredential
description: Workspace delegated admin (or super-admin) with the USER_MANAGEMENT / password-reset privilege
  can reset any non-admin user's password, hijacking their account.
match:
- - admin: null
  - HasRole
  - delegated_role: null
where:
- node_type(?admin) == HumanIdentity
- ?admin.suspended == false
- '(?delegated_role.has_privilege == ''USER_MANAGEMENT''    # includes password reset OR ?admin.is_super_admin
  == true)'
emit:
  source_type: Identity
  target_type: HumanIdentity
  source: ?admin
  target: <any non-super-admin HumanIdentity in the domain>
  permissions: []
  conditions:
  - service_state
  state_logic: 'ACTIVE if ?admin holds the USER_MANAGEMENT privilege (delegated admin) or is a super-admin
    (isAdmin=true), and the target user is not a super-admin (isAdmin=false). CONDITIONAL(service_state)
    if the admin account itself is suspended or if the admin lacks DWD authorization for admin.directory.*
    scopes. BLOCKED if organizational security controls prevent admin password reset (e.g., Workspace
    for Enterprise Plus admin-protection policies). Note: password reset is a Workspace directory admin
    privilege, not a GCP IAM permission. The gating factor is the admin role''s USER_MANAGEMENT privilege,
    checked via Directory API roleAssignments.list.'
  confidence: 0.92
  derived_from:
  - "Directory API roleAssignments.list \u2192 role with USER_MANAGEMENT privilege; OR users.list isAdmin=true"
  false_positive_note: "Password reset is a Workspace admin privilege (USER_MANAGEMENT), not a GCP IAM\
    \ permission. Verify via Directory API roleAssignments.list that the admin role has USER_MANAGEMENT\
    \ privilege. Delegated admins CANNOT reset super-admin passwords \u2014 exclude super-admin (isAdmin=true)\
    \ users from the target set for delegated-admin rules. A super-admin CAN reset other super-admin passwords,\
    \ so for the super-admin case, all users are valid targets. Workspace for Enterprise Plus supports\
    \ protected admin accounts that cannot be reset by other admins without a recovery flow \u2014 if\
    \ this is detected, downgrade to CONDITIONAL. The admin.directory.users.update call sets the password\
    \ field; the attacker must then authenticate via the Google sign-in page (or API) to complete the\
    \ takeover \u2014 this is a real but interactive step. Suspended admin accounts (suspended=true) cannot\
    \ perform this action."
  narrative: '{admin.name} holds the Workspace USER_MANAGEMENT privilege (or is a super-admin) and can
    reset any non-super-admin user''s password via admin.directory.users.update, then authenticate as
    that user. This enables account takeover of any domain user whose identity inherits GCP IAM roles
    (especially useful when the target user is a member of privileged groups or holds direct GCP role
    bindings).'