gcp-cloudsql-explicit-can-administer

id: gcp-cloudsql-explicit-can-administer
emits: CanAdminister
description: roles/cloudsql.admin (including cloudsql.instances.* permissions) grants full administrative
  control over Cloud SQL instances.
applies_to:
- gcp
match_effective_permission:
  action: cloudsql.instances.*
  resource_type: google.sql.Instance
emit:
  source_type: Identity
  target_type: RelationalDatabase
  source: <principal>
  target: <Cloud SQL Instance node>
  permissions:
  - cloudsql.instances.*
  conditions:
  - iam_permission
  state_logic: ACTIVE when cloudsql.instances.* is confirmed effective (via wildcard or explicit enumeration
    of admin-level actions); CONDITIONAL(iam_permission) when uncertain; BLOCKED when IAM deny policy
    denies the admin action set.
  false_positive_note: 'The cloudsql.instances.* wildcard permission (or explicit enumeration of all admin
    actions) appears in roles/cloudsql.admin and is granted at project scope. This implies: password reset
    (users.update), data export (instances.export), public IP change (instances.update), and all other
    instance management operations. Downgrade to CONDITIONAL if only a subset of admin actions is confirmed.'
  narrative: '{principal.name} holds roles/cloudsql.admin (cloudsql.instances.* admin actions) on {instance.name}
    and can administer the instance (reset passwords, export data, modify configuration, delete/recreate).'
  api_source: Cloud Asset Inventory analyzeIamPolicy (cloudsql.instances.*)
  evidence_field: roles/cloudsql.admin or explicit cloudsql.instances.* permission
  derived_from:
  - cloudsql.instances.* effective permission on google.sql.Instance