gcp-cloudsql-explicit-can-reset-credential

id: gcp-cloudsql-explicit-can-reset-credential
emits: CanResetCredential
description: cloudsql.users.update on a Cloud SQL instance lets a principal reset any DB user's password,
  including root/admin DB users.
applies_to:
- gcp
match_effective_permission:
  action: cloudsql.users.update
  resource_type: google.sql.Instance
where:
- target is a root or admin-level built-in DB user (internal engine identity)
emit:
  source_type: Identity
  target_type: GenericIdentity
  source: <principal>
  target: <Cloud SQL root/admin DB user node (GenericIdentity)>
  permissions:
  - cloudsql.users.update
  conditions:
  - iam_permission
  state_logic: ACTIVE when cloudsql.users.update is confirmed effective on the instance scope (project-level
    role binding without restricting IAM Condition, or IAM Condition scopes to this instance); CONDITIONAL(iam_permission)
    when uncertain; BLOCKED when IAM deny policy explicitly denies cloudsql.users.update.
  false_positive_note: cloudsql.users.update is included in roles/cloudsql.editor and roles/cloudsql.admin,
    both granted at project level. Password reset yields full DB access ONLY when targeting root/admin
    with all-database grants. VPC Service Controls enclosing sqladmin.googleapis.com block the API call
    for out-of-perimeter principals -> BLOCKED(resource_policy).
  narrative: '{principal.name} holds cloudsql.users.update on instance {instance.name} and can reset the
    root DB user password, taking over that DB user identity.'
  api_source: Cloud Asset Inventory analyzeIamPolicy (cloudsql.users.update) + sqladmin.users.list (root
    user record)
  evidence_field: cloudsql.users.update effective permission + root user record in sqladmin.users.list
  derived_from:
  - cloudsql.users.update effective permission on google.sql.Instance