gcp-cloudbuild-workerpool-update-config
cloudbuild.workerpools.update lets the principal change a private worker pool's VPC peering configuration, redirecting future builds' network access.
match (effective permission)
{
"action": "cloudbuild.workerpools.update",
"resource_type": "google.devtools.cloudbuild.v1.WorkerPool"
}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <Cloud Build private worker pool> |
| permissions | cloudbuild.workerpools.update |
| conditions | iam_permission service_state |
| state logic | ACTIVE if cloudbuild.workerpools.update is confirmed in the effective grant. Attack value (network misdirection) is CONDITIONAL on future builds using the pool (cloudbuild.workerpools.use) and a run path existing. BLOCKED if a deny policy applies. |
Narrative
{principal.name} can update the Cloud Build private worker pool {pool.name} (cloudbuild.workerpools.update), changing its VPC peering configuration and redirecting future builds' private network access.
Raw rule rules/derived/gcp/cloudbuild.yaml
id: gcp-cloudbuild-workerpool-update-config
emits: CanModifyConfiguration
description: cloudbuild.workerpools.update lets the principal change a private worker pool's VPC peering
configuration, redirecting future builds' network access.
match_effective_permission:
action: cloudbuild.workerpools.update
resource_type: google.devtools.cloudbuild.v1.WorkerPool
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <Cloud Build private worker pool>
permissions:
- cloudbuild.workerpools.update
conditions:
- iam_permission
- service_state
state_logic: ACTIVE if cloudbuild.workerpools.update is confirmed in the effective grant. Attack value
(network misdirection) is CONDITIONAL on future builds using the pool (cloudbuild.workerpools.use)
and a run path existing. BLOCKED if a deny policy applies.
confidence: 0.8
derived_from:
- <cloudbuild.workerpools.update effective permission>
false_positive_note: "Changing the peered VPC does not affect RUNNING builds \u2014 only future builds\
\ dispatched to the pool after the update. The attack is: update pool -> next build that uses it runs\
\ in the new VPC context. Requires that future builds use the pool (cloudbuild.workerpools.use bindings)\
\ and that the attacker's VPC has useful resources or that the new peering exposes a private resource\
\ previously isolated."
narrative: '{principal.name} can update the Cloud Build private worker pool {pool.name} (cloudbuild.workerpools.update),
changing its VPC peering configuration and redirecting future builds'' private network access.'