gcp-cloudsql-explicit-enable-iam-auth

id: gcp-cloudsql-explicit-enable-iam-auth
emits: CanModifyConfiguration
description: cloudsql.instances.update can enable IAM database authentication (cloudsql.iam_authentication
  database flag), unlocking passwordless DB login for instanceUser principals.
applies_to:
- gcp
match_effective_permission:
  action: cloudsql.instances.update
  resource_type: google.sql.Instance
where:
- instance.settings.databaseFlags does NOT already have cloudsql.iam_authentication=on (toggling it on
  is the security-relevant change)
emit:
  source_type: Identity
  target_type: RelationalDatabase
  source: <principal>
  target: <Cloud SQL Instance node>
  permissions:
  - cloudsql.instances.update
  conditions:
  - iam_permission
  state_logic: ACTIVE when cloudsql.instances.update is confirmed effective on the instance and IAM auth
    flag is currently off; CONDITIONAL(iam_permission) when uncertain; BLOCKED when org policy or IAM
    deny blocks cloudsql.instances.update.
  false_positive_note: "cloudsql.instances.update covers many config changes (network, tier, disk, backup).\
    \ This rule specifically identifies IAM auth flag toggle as a security-relevant change. Flag change\
    \ requires instance restart for PostgreSQL (not MySQL). After enabling, attacker must ALSO create\
    \ IAM DB user record (cloudsql.users.create or IAM group feature) to actually use it \u2014 enabling\
    \ the flag alone does not create DB users. Downgrade to POTENTIAL when no instanceUser-level principal\
    \ would benefit."
  narrative: '{principal.name} holds cloudsql.instances.update on {instance.name} and can enable IAM database
    authentication (cloudsql.iam_authentication=on), unlocking passwordless DB login for any principal
    with roles/cloudsql.instanceUser.'
  api_source: Cloud Asset Inventory analyzeIamPolicy (cloudsql.instances.update) + sqladmin.instances.get
    (databaseFlags)
  evidence_field: cloudsql.instances.update permission + databaseFlags state
  derived_from:
  - cloudsql.instances.update effective permission on google.sql.Instance