gcp-dataproc-cluster-set-iam-policy
dataproc.clusters.setIamPolicy lets a principal rewrite the cluster's IAM policy - self-granting dataproc.jobs.create -> CanExecuteCommand -> CanExecuteAs.
match (effective permission)
{
"action": "dataproc.clusters.setIamPolicy",
"resource_type": "google.dataproc.Cluster"
}
emit
| source type | Identity |
|---|---|
| target type | AnalyticsService |
| source | <principal> |
| target | <Dataproc cluster> |
| permissions | dataproc.clusters.setIamPolicy |
| conditions | iam_permission |
| state logic | ACTIVE when the effective permission is confirmed. BLOCKED if an IAM deny or org policy blocks setIamPolicy. This is a CanGrantPermission primitive: the principal can grant dataproc.jobs.create to itself on the cluster, then proceed to submit a job -> CanExecuteAs(clusterSA). The CanGrantPermission collapse is handled by can-control control-boundary-via-iam-admin. |
Narrative
{principal.name} can rewrite {cluster.name}'s IAM policy (dataproc.clusters.setIamPolicy), self-granting dataproc.jobs.create to execute arbitrary code as the cluster SA.
Raw rule rules/derived/gcp/dataproc.yaml
id: gcp-dataproc-cluster-set-iam-policy
emits: CanModifyPolicy
description: "dataproc.clusters.setIamPolicy lets a principal rewrite the cluster's IAM policy \u2014\
\ self-granting dataproc.jobs.create -> CanExecuteCommand -> CanExecuteAs."
match_effective_permission:
action: dataproc.clusters.setIamPolicy
resource_type: google.dataproc.Cluster
emit:
source_type: Identity
target_type: AnalyticsService
source: <principal>
target: <Dataproc cluster>
permissions:
- dataproc.clusters.setIamPolicy
conditions:
- iam_permission
state_logic: 'ACTIVE when the effective permission is confirmed. BLOCKED if an IAM deny or org policy
blocks setIamPolicy. This is a CanGrantPermission primitive: the principal can grant dataproc.jobs.create
to itself on the cluster, then proceed to submit a job -> CanExecuteAs(clusterSA). The CanGrantPermission
collapse is handled by can-control control-boundary-via-iam-admin.'
false_positive_note: setIamPolicy on a cluster grants CLUSTER-LEVEL IAM only; it cannot grant project-level
roles (resourcemanager.projects.setIamPolicy is separate). The granted jobs.create is cluster-scoped,
so the principal can submit jobs to this specific cluster. This is high-value because it bypasses
needing pre-existing job-submit rights.
narrative: '{principal.name} can rewrite {cluster.name}''s IAM policy (dataproc.clusters.setIamPolicy),
self-granting dataproc.jobs.create to execute arbitrary code as the cluster SA.'