gcp-cloudbuild-private-pool-network-reach
A Cloud Build private worker pool peered into a VPC gives build steps network access to private resources in that VPC.
match (record)
{
"field": "privatePoolV1Config.networkConfig.peeredNetwork",
"resource_type": "google.devtools.cloudbuild.v1.WorkerPool"
}
where
workerPool.privatePoolV1Config.networkConfig.peeredNetwork is set to VPC network ?vpc
emit
| source type | Compute |
|---|---|
| target type | Compute |
| source | <Cloud Build private worker pool / BuildWorker> |
| target | <private resources reachable via peered VPC network ?vpc> |
| permissions | cloudbuild.workerpools.use |
| conditions | network_reachability service_state |
| state logic | ACTIVE if the worker pool's peeredNetwork field references an active VPC and the VPC peering is established (not merely requested). CONDITIONAL(network_reachability) if peering status is pending or if the private resource's subnet is not routable via the peered network. This edge is a structural fact of the pool topology; attack value requires a CanExecuteAs or CanModifyCode edge on the build node as a prerequisite. |
Narrative
Cloud Build private worker pool {pool.name} is peered into VPC {vpc.name}; build steps executing in this pool can reach private resources in the peered network (databases, internal APIs, on-prem hosts via VPN/Interconnect).
Raw rule rules/derived/gcp/cloudbuild.yaml
id: gcp-cloudbuild-private-pool-network-reach
emits: CanNetworkReach
description: A Cloud Build private worker pool peered into a VPC gives build steps network access to private
resources in that VPC.
match_record:
resource_type: google.devtools.cloudbuild.v1.WorkerPool
field: privatePoolV1Config.networkConfig.peeredNetwork
where:
- workerPool.privatePoolV1Config.networkConfig.peeredNetwork is set to VPC network ?vpc
emit:
source_type: Compute
target_type: Compute
source: <Cloud Build private worker pool / BuildWorker>
target: <private resources reachable via peered VPC network ?vpc>
permissions:
- cloudbuild.workerpools.use
conditions:
- network_reachability
- service_state
state_logic: ACTIVE if the worker pool's peeredNetwork field references an active VPC and the VPC peering
is established (not merely requested). CONDITIONAL(network_reachability) if peering status is pending
or if the private resource's subnet is not routable via the peered network. This edge is a structural
fact of the pool topology; attack value requires a CanExecuteAs or CanModifyCode edge on the build
node as a prerequisite.
confidence: 0.85
derived_from:
- <WorkerPool.privatePoolV1Config.networkConfig.peeredNetwork field>
false_positive_note: "Not a standalone escalation \u2014 network reachability via the pool is only useful\
\ when combined with code execution in the build (CanModifyCode/CanExecuteAs into the BuildWorker).\
\ Verify that the peered network's routing and firewall rules actually permit traffic to the target\
\ resource; a pool peered to a VPC does not automatically reach all resources in that VPC. Use cloudbuild.workerpools.use\
\ to gate which builds run in the pool (without this permission a build cannot use the pool)."
narrative: Cloud Build private worker pool {pool.name} is peered into VPC {vpc.name}; build steps executing
in this pool can reach private resources in the peered network (databases, internal APIs, on-prem
hosts via VPN/Interconnect).