gcp-dataproc-batch-create-workload-as

Create a serverless Dataproc Batch job bound to a passable SA; the job runs as that SA immediately on creation.

derived gcp emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ServiceAccount`
source	`?principal`
target	`?sa`
permissions	`dataproc.batches.create` `iam.serviceAccounts.actAs`
conditions	`iam_permission`
state logic	ACTIVE when both CanPassIdentity and dataproc.batches.create are confirmed; POTENTIAL(iam_permission) when either permission is unconfirmed. No trigger_exists condition: batch jobs run on creation. CITE can-execute-as execute-as-via-new-workload for the CanExecuteAs collapse.

source type

Identity

target type

ServiceAccount

source

?principal

target

?sa

permissions

dataproc.batches.create iam.serviceAccounts.actAs

conditions

iam_permission

state logic

ACTIVE when both CanPassIdentity and dataproc.batches.create are confirmed; POTENTIAL(iam_permission) when either permission is unconfirmed. No trigger_exists condition: batch jobs run on creation. CITE can-execute-as execute-as-via-new-workload for the CanExecuteAs collapse.

Narrative

{principal.name} can create a serverless Dataproc Batch job (dataproc.batches.create) whose Spark job runs immediately as {sa.name} with attacker-controlled code.

Raw rule rules/derived/gcp/dataproc.yaml

id: gcp-dataproc-batch-create-workload-as
emits: CanCreateWorkloadAs
description: Create a serverless Dataproc Batch job bound to a passable SA; the job runs as that SA immediately
  on creation.
match:
- - principal: null
  - CanPassIdentity
  - sa: null
where:
- ?principal has dataproc.batches.create in the target project/location
- ?principal has iam.serviceAccounts.actAs on ?sa
- node_type(?sa) == ServiceAccount
emit:
  source_type: Identity
  target_type: ServiceAccount
  source: ?principal
  target: ?sa
  permissions:
  - dataproc.batches.create
  - iam.serviceAccounts.actAs
  conditions:
  - iam_permission
  state_logic: 'ACTIVE when both CanPassIdentity and dataproc.batches.create are confirmed; POTENTIAL(iam_permission)
    when either permission is unconfirmed. No trigger_exists condition: batch jobs run on creation. CITE
    can-execute-as execute-as-via-new-workload for the CanExecuteAs collapse.'
  derived_from:
  - ?principal CanPassIdentity ?sa (gcp-dataproc-explicit-can-pass-identity)
  false_positive_note: "The CanPassIdentity edge must be established via the explicit normalizer (gcp-dataproc-explicit-can-pass-identity),\
    \ which confirms both actAs and batches.create. actAs per-SA \u2014 no blanket SA-service actAs available.\
    \ The runnable is fully attacker-controlled."
  narrative: '{principal.name} can create a serverless Dataproc Batch job (dataproc.batches.create) whose
    Spark job runs immediately as {sa.name} with attacker-controlled code.'