gcp-datafusion-pipeline-deploy-modifies-code

id: gcp-datafusion-pipeline-deploy-modifies-code
emits: CanModifyCode
description: datafusion.instances.update (GCP IAM) + CDAP pipeline write access lets a principal deploy
  or replace a pipeline definition, injecting arbitrary code executed as the instance's dataprocServiceAccount
  on an ephemeral Dataproc cluster.
match_effective_permission:
  action: datafusion.instances.update
  resource_type: google.datafusion.Instance
where:
- principal also holds CDAP-level pipeline write access (Editor or Admin role within the CDAP namespace,
  or equivalent internal RBAC)
- 'node_type(datafusion-instance) == AnalyticsService or GenericCompute  # modeled as Compute for cicd-chains
  compatibility'
emit:
  source_type: Identity
  target_type: Compute
  source: <principal>
  target: <Cloud Data Fusion instance (AnalyticsService / GenericCompute node)>
  permissions:
  - datafusion.instances.update
  conditions:
  - iam_permission
  - api_enabled
  state_logic: "ACTIVE if datafusion.instances.update is confirmed in the effective grant AND CDAP-level\
    \ pipeline write access is confirmed (CDAP namespace Editor/Admin). If only the GCP IAM permission\
    \ is confirmed but CDAP-level access is unresolved: CONDITIONAL(iam_permission) \u2014 the GCP IAM\
    \ gate is satisfied but the CDAP gate is unknown. BLOCKED if a deny policy (IAM deny or org policy)\
    \ applies to datafusion.instances.update. The downstream CanExecuteAs collapse (from can-execute-as\
    \ execute-as-via-code-modify + cicd-chains) is ACTIVE when both this CanModifyCode and the ExecutesAs\
    \ structural edge are ACTIVE."
  confidence: 0.88
  derived_from:
  - <datafusion.instances.update effective permission on principal>
  false_positive_note: "GCP IAM `datafusion.instances.update` controls the instance control-plane (SA\
    \ binding, network, version). CDAP pipeline deployment uses the CDAP REST API inside the instance,\
    \ governed by CDAP-internal namespace RBAC (separate from GCP IAM). Do NOT emit ACTIVE when only the\
    \ GCP IAM permission is confirmed \u2014 CDAP-level pipeline write access must also be established.\
    \ Downgrade to CONDITIONAL(iam_permission) when CDAP access is unresolved. This rule emits the CanModifyCode\
    \ fact only; the CanExecuteAs collapse is produced by can-execute-as execute-as-via-code-modify (cited,\
    \ not re-derived)."
  narrative: '{principal.name} can deploy or replace a Cloud Data Fusion pipeline definition (datafusion.instances.update
    + CDAP pipeline write), injecting arbitrary Spark/Java/plugin code. The pipeline executes on an ephemeral
    Dataproc cluster as the instance''s dataprocServiceAccount, granting {principal.name} code execution
    as that SA.'