gcp-datafusion-exposes-pipeline-sa-cred

All Dataproc nodes in a Data Fusion pipeline cluster can retrieve OAuth tokens for the dataprocServiceAccount from the GCE metadata server; code execution in any pipeline step yields those credentials.

derived gcp emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Compute`
target type	`Identity`
source	`<Cloud Data Fusion instance>`
target	`<dataprocServiceAccount (?sa)>`
state logic	ACTIVE: structural fact. The GCE metadata server is always reachable from Dataproc cluster nodes. This edge only becomes an attack step when combined with a CanModifyCode or CanExecuteAs edge on the instance. Not a standalone escalation.

source type

Compute

target type

Identity

source

<Cloud Data Fusion instance>

target

<dataprocServiceAccount (?sa)>

state logic

ACTIVE: structural fact. The GCE metadata server is always reachable from Dataproc cluster nodes. This edge only becomes an attack step when combined with a CanModifyCode or CanExecuteAs edge on the instance. Not a standalone escalation.

Narrative

Code running in any {instance.name} pipeline step can retrieve an OAuth 2.0 access token for {sa.name} from the GCE metadata server (http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token), granting all of {sa.name}'s IAM roles to any pipeline code.

Raw rule rules/derived/gcp/datastream.yaml

id: gcp-datafusion-exposes-pipeline-sa-cred
emits: ExposesCredential
description: All Dataproc nodes in a Data Fusion pipeline cluster can retrieve OAuth tokens for the dataprocServiceAccount
  from the GCE metadata server; code execution in any pipeline step yields those credentials.
match:
- - ?instance
  - ExecutesAs
  - ?sa
where:
- 'node_type(?instance) in [AnalyticsService, GenericCompute]  # Data Fusion instance'
emit:
  source_type: Compute
  target_type: Identity
  source: <Cloud Data Fusion instance>
  target: <dataprocServiceAccount (?sa)>
  permissions: []
  conditions: []
  state_logic: 'ACTIVE: structural fact. The GCE metadata server is always reachable from Dataproc cluster
    nodes. This edge only becomes an attack step when combined with a CanModifyCode or CanExecuteAs edge
    on the instance. Not a standalone escalation.'
  confidence: 1.0
  derived_from:
  - <ExecutesAs edge_id for ?instance -> ?sa>
  false_positive_note: "Not an escalation by itself \u2014 expresses that code execution in a pipeline\
    \ step equals holding the dataprocServiceAccount's credentials. Attack value is gated by an upstream\
    \ CanModifyCode or CanExecuteAs capability. The ephemeral Dataproc cluster is torn down after the\
    \ pipeline run; the credential exposure is transient but real during execution."
  narrative: Code running in any {instance.name} pipeline step can retrieve an OAuth 2.0 access token
    for {sa.name} from the GCE metadata server (http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token),
    granting all of {sa.name}'s IAM roles to any pipeline code.