gcp-cloudbuild-set-iam-policy-connection
cloudbuild.connections.setIamPolicy lets the principal grant or revoke access to a Cloud Build repository connection, potentially enabling unauthorized source token access.
match (effective permission)
{
"action": "cloudbuild.connections.setIamPolicy",
"resource_type": "google.devtools.cloudbuild.v1.Connection"
}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <Cloud Build repository connection> |
| permissions | cloudbuild.connections.setIamPolicy |
| conditions | iam_permission |
| state logic | ACTIVE if cloudbuild.connections.setIamPolicy is in the effective grant at the connection or project scope. BLOCKED if a deny policy applies. |
Narrative
{principal.name} can set the IAM policy of Cloud Build connection {connection.name} (cloudbuild.connections.setIamPolicy), granting itself or others access to read or write repository tokens for the connected SCM source.
Raw rule rules/derived/gcp/cloudbuild.yaml
id: gcp-cloudbuild-set-iam-policy-connection
emits: CanModifyPolicy
description: cloudbuild.connections.setIamPolicy lets the principal grant or revoke access to a Cloud
Build repository connection, potentially enabling unauthorized source token access.
match_effective_permission:
action: cloudbuild.connections.setIamPolicy
resource_type: google.devtools.cloudbuild.v1.Connection
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <Cloud Build repository connection>
permissions:
- cloudbuild.connections.setIamPolicy
conditions:
- iam_permission
state_logic: ACTIVE if cloudbuild.connections.setIamPolicy is in the effective grant at the connection
or project scope. BLOCKED if a deny policy applies.
confidence: 0.85
derived_from:
- <cloudbuild.connections.setIamPolicy effective permission>
false_positive_note: "setIamPolicy on the connection resource enables granting cloudbuild.repositories.\
\ accessReadWriteToken to arbitrary principals, which gives them write-level SCM tokens (a code-write\
\ / source-poisoning path). This is a meaningful downstream capability \u2014 flag the connection's\
\ token permissions alongside this edge."
narrative: '{principal.name} can set the IAM policy of Cloud Build connection {connection.name} (cloudbuild.connections.setIamPolicy),
granting itself or others access to read or write repository tokens for the connected SCM source.'