gcp-cloudarmor-weaken-policy

id: gcp-cloudarmor-weaken-policy
emits: CanModifyConfiguration
description: "compute.securityPolicies.update lets a principal modify rules in a Cloud Armor security\
  \ policy \u2014 deleting DENY rules, removing geo/IP blocks, disabling adaptive protection, or inserting\
  \ a catch-all ALLOW \u2014 weakening the WAF/DDoS edge access control protecting the attached HTTP(S)\
  \ LB backend."
match_effective_permission:
  action: compute.securityPolicies.update
  resource_type: compute.googleapis.com/SecurityPolicy
where:
- the security policy is attached to at least one BackendService whose load-balancing-scheme is EXTERNAL
  or EXTERNAL_MANAGED (internal LBs do not use Cloud Armor)
- the security policy contains at least one rule with action DENY, THROTTLE, or REDIRECT (if all rules
  are ALLOW, weakening has no marginal effect)
emit:
  source_type: Identity
  target_type: GenericNetwork
  source: <principal>
  target: <Cloud Armor SecurityPolicy node>
  permissions:
  - compute.securityPolicies.update
  conditions:
  - iam_permission
  state_logic: 'ACTIVE: the IAM permission compute.securityPolicies.update is sufficient to invoke the
    control-plane API and mutate the security policy rules immediately. The capability exists unconditionally
    once the effective permission is confirmed. Downgrade to POTENTIAL when the policy''s attachment to
    an external-LB backend cannot be confirmed. BLOCKED if an IAM deny policy denies compute.securityPolicies.update
    at the effective scope, or if an org policy constraint prevents security policy mutation (denied_by=<deny
    policy or org constraint>).'
  confidence: min(contributing_confidences) * 0.75
  derived_from:
  - <effective compute.securityPolicies.update IAM grant on the SecurityPolicy>
  false_positive_note: "(1) The policy MUST be attached to an internet-facing (EXTERNAL or EXTERNAL_MANAGED)\
    \ backend service \u2014 Cloud Armor does not apply to internal LBs. (2) compute.securityPolicies.update\
    \ does NOT grant the ability to attach a policy to a backend service; that requires compute.backendServices.update\
    \ + compute.securityPolicies.use (a separate, broader privilege). (3) If the policy only contains\
    \ ALLOW rules (no DENY/THROTTLE/REDIRECT), there is no access control to weaken \u2014 emit with very\
    \ low confidence or suppress. (4) IMPACT CONDITIONALITY: an attacker whose source traffic was already\
    \ allowed by the existing policy gains nothing from weakening it; impact is realized only when the\
    \ attacker's source was PREVIOUSLY BLOCKED by a rule in this policy AND the backend LB is internet-reachable.\
    \ This is an impact/scoring concern, not a capability-state concern (emitted ACTIVE). (5) roles/compute.securityAdmin,\
    \ roles/compute.networkAdmin, roles/compute.admin, roles/editor, and roles/owner all include this\
    \ permission. Confirm the effective permission (accounting for IAM deny policies and org policy constraints)\
    \ before emitting."
  narrative: '{principal.name} holds compute.securityPolicies.update on {target.name} and can remove or
    weaken DENY, THROTTLE, geo-block, IP allowlist, or adaptive-protection rules in this Cloud Armor security
    policy. This lifts the WAF/DDoS edge access control protecting the HTTP(S) load balancer backend(s)
    that reference this policy, allowing previously-blocked traffic to reach the backend application.'