gcp-ci-group-member-remove

Principal with cloudidentity.groups.memberships.delete (or group Manager/Owner) can remove members from the target group, enabling member deprovisioning or audit-trail destruction.

derived gcp emits CanRemoveMember

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Group`
source	`?principal`
target	`?group`
permissions	`cloudidentity.groups.memberships.delete`
conditions	`iam_permission`
state logic	ACTIVE if effective permission is confirmed at the group scope (role binding that grants cloudidentity.groups.memberships.delete, or the principal is a group MANAGER/OWNER). CONDITIONAL(iam_permission) if permission is inherited from a parent resource and not yet confirmed. BLOCKED if an IAM deny policy explicitly denies cloudidentity.groups.memberships.delete on the group.

source type

Identity

target type

Group

source

?principal

target

?group

permissions

cloudidentity.groups.memberships.delete

conditions

iam_permission

state logic

ACTIVE if effective permission is confirmed at the group scope (role binding that grants cloudidentity.groups.memberships.delete, or the principal is a group MANAGER/OWNER). CONDITIONAL(iam_permission) if permission is inherited from a parent resource and not yet confirmed. BLOCKED if an IAM deny policy explicitly denies cloudidentity.groups.memberships.delete on the group.

Narrative

{principal.name} can remove members from {group.name} (cloudidentity.groups.memberships.delete or group Manager/Owner role). While not directly escalatory, this can disrupt alerting/audit channels or enable persistence by removing evidence of a breach.

Raw rule rules/derived/gcp/cloudidentity.yaml

id: gcp-ci-group-member-remove
emits: CanRemoveMember
description: Principal with cloudidentity.groups.memberships.delete (or group Manager/Owner) can remove
  members from the target group, enabling member deprovisioning or audit-trail destruction.
match:
- - principal: null
  - HasPermission
  - group: null
where:
- node_type(?group) == Group
- effective_permission(?principal, cloudidentity.groups.memberships.delete, ?group) == true OR membership_role(?principal,
  ?group) in [MANAGER, OWNER]
emit:
  source_type: Identity
  target_type: Group
  source: ?principal
  target: ?group
  permissions:
  - cloudidentity.groups.memberships.delete
  conditions:
  - iam_permission
  state_logic: ACTIVE if effective permission is confirmed at the group scope (role binding that grants
    cloudidentity.groups.memberships.delete, or the principal is a group MANAGER/OWNER). CONDITIONAL(iam_permission)
    if permission is inherited from a parent resource and not yet confirmed. BLOCKED if an IAM deny policy
    explicitly denies cloudidentity.groups.memberships.delete on the group.
  confidence: 0.9
  derived_from:
  - effective cloudidentity.groups.memberships.delete on ?group (or MANAGER/OWNER membership role)
  false_positive_note: 'CanRemoveMember is walkable: false in the schema (not traversed by default in
    attack paths) because membership removal is primarily destructive, not escalation. However, it can
    be used for persistence (removing audit members) or disruption (removing security team members from
    critical groups). Only emit if the principal holds the explicit delete permission or a MANAGER/OWNER
    membership role.'
  narrative: '{principal.name} can remove members from {group.name} (cloudidentity.groups.memberships.delete
    or group Manager/Owner role). While not directly escalatory, this can disrupt alerting/audit channels
    or enable persistence by removing evidence of a breach.'