gcp-dataproc-cluster-update-modify-config
dataproc.clusters.update allows changing the cluster's service account (and other runtime config), which with actAs on the new SA swaps the cluster's execution identity.
match (effective permission)
{
"action": "dataproc.clusters.update",
"resource_type": "google.dataproc.Cluster"
}
emit
| source type | Identity |
|---|---|
| target type | AnalyticsService |
| source | <principal> |
| target | <Dataproc cluster> |
| permissions | dataproc.clusters.update |
| conditions | iam_permission |
| state logic | ACTIVE when dataproc.clusters.update is confirmed (project- or cluster-level). BLOCKED if an IAM deny or org policy denies the action. Swapping the cluster SA additionally requires iam.serviceAccounts.actAs on the new SA (gated by CanPassIdentity). Note: not all update fields are security-relevant; only config.gceClusterConfig.serviceAccount and config.gceClusterConfig.metadata are direct escalation paths — the rule conservatively emits CanModifyConfiguration for all dataproc.clusters.update grants. |
Narrative
{principal.name} can update {cluster.name}'s configuration (dataproc.clusters.update), including swapping the cluster SA; combined with actAs on a chosen SA, this changes the execution identity for all future jobs on the cluster.
Raw rule rules/derived/gcp/dataproc.yaml
id: gcp-dataproc-cluster-update-modify-config
emits: CanModifyConfiguration
description: dataproc.clusters.update allows changing the cluster's service account (and other runtime
config), which with actAs on the new SA swaps the cluster's execution identity.
match_effective_permission:
action: dataproc.clusters.update
resource_type: google.dataproc.Cluster
emit:
source_type: Identity
target_type: AnalyticsService
source: <principal>
target: <Dataproc cluster>
permissions:
- dataproc.clusters.update
conditions:
- iam_permission
state_logic: "ACTIVE when dataproc.clusters.update is confirmed (project- or cluster-level). BLOCKED\
\ if an IAM deny or org policy denies the action. Swapping the cluster SA additionally requires iam.serviceAccounts.actAs\
\ on the new SA (gated by CanPassIdentity). Note: not all update fields are security-relevant; only\
\ config.gceClusterConfig.serviceAccount and config.gceClusterConfig.metadata are direct escalation\
\ paths \u2014 the rule conservatively emits CanModifyConfiguration for all dataproc.clusters.update\
\ grants."
false_positive_note: dataproc.clusters.update without actAs on the new SA cannot change the cluster
SA (the API rejects the request). Do not emit CanAttachIdentity or CanExecuteAs from this rule alone;
the CanPassIdentity edge is required to complete the chain. CITE can-execute-as execute-as-via-config-identity-swap
for the CanExecuteAs collapse when CanModifyConfiguration + CanPassIdentity both exist.
narrative: '{principal.name} can update {cluster.name}''s configuration (dataproc.clusters.update),
including swapping the cluster SA; combined with actAs on a chosen SA, this changes the execution
identity for all future jobs on the cluster.'