gcp-dataflow-exposes-worker-sa-cred

Dataflow worker SA credentials accessible via metadata server to code running in pipeline transforms (when execution is established via CanModifyCode or CanExecuteAs).

derived gcp emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Compute`
target type	`Identity`
source	`<Dataflow Job node>`
target	`<worker service account>`
conditions	`execution_injection`
state logic	CONDITIONAL(execution_injection): ExposesCredential is only a viable attack step when combined with CanModifyCode (updateContents injection) or CanExecuteAs (attacker code running in pipeline). Without upstream injection capability, this edge is not exploitable. Emit CONDITIONAL to reflect the gate.

source type

Compute

target type

Identity

source

<Dataflow Job node>

target

<worker service account>

conditions

execution_injection

state logic

CONDITIONAL(execution_injection): ExposesCredential is only a viable attack step when combined with CanModifyCode (updateContents injection) or CanExecuteAs (attacker code running in pipeline). Without upstream injection capability, this edge is not exploitable. Emit CONDITIONAL to reflect the gate.

Narrative

Code running in {job.name} pipeline transforms can retrieve OAuth 2.0 access tokens for worker service account {sa.name} from the GCE metadata server, effectively granting all of {sa.name}'s IAM roles to any attacker code in the pipeline (contingent on execution-injection capability).

Raw rule rules/derived/gcp/dataflow.yaml

id: gcp-dataflow-exposes-worker-sa-cred
emits: ExposesCredential
description: Dataflow worker SA credentials accessible via metadata server to code running in pipeline
  transforms (when execution is established via CanModifyCode or CanExecuteAs).
match:
- - ?job
  - ExecutesAs
  - ?sa
where:
- node_type(?job) == BatchJob
- ?job is a google.dataflow.Job
- ?job has an incoming CanModifyCode OR CanExecuteAs edge (attacker-controlled code in pipeline is present
  or possible)
emit:
  source_type: Compute
  target_type: Identity
  source: <Dataflow Job node>
  target: <worker service account>
  permissions: []
  conditions:
  - execution_injection
  state_logic: 'CONDITIONAL(execution_injection): ExposesCredential is only a viable attack step when
    combined with CanModifyCode (updateContents injection) or CanExecuteAs (attacker code running in pipeline).
    Without upstream injection capability, this edge is not exploitable. Emit CONDITIONAL to reflect the
    gate.'
  confidence: 1.0
  derived_from:
  - <ExecutesAs edge_id for ?job -> ?sa>
  false_positive_note: Only emit ACTIVE or CONDITIONAL when an upstream execution-injection edge (CanModifyCode
    via updateContents or CanExecuteAs from job creation) is confirmed. Absence of injection capability
    -> do not emit. This prevents over-claiming credential exposure on all Dataflow jobs and keeps the
    graph signal-to-noise ratio high.
  narrative: Code running in {job.name} pipeline transforms can retrieve OAuth 2.0 access tokens for worker
    service account {sa.name} from the GCE metadata server, effectively granting all of {sa.name}'s IAM
    roles to any attacker code in the pipeline (contingent on execution-injection capability).