gcp-dataproc-cross-project-trust
A Dataproc cluster whose service account belongs to a different project creates a cross-project trust; code in jobs runs as a SA from another project.
match (record)
{
"field": "config.gceClusterConfig.serviceAccount",
"resource_type": "google.dataproc.Cluster"
}
where
the SA's project (parsed from SA email: sa-name@PROJECT_ID.iam.gserviceaccount.com) != the cluster's project
emit
| source type | Project |
|---|---|
| target type | Project |
| source | <cluster's project> |
| target | <SA's home project> |
| conditions | role_compatibility |
| state logic | ACTIVE when the cross-project SA usage is confirmed (SA email domain != cluster project). BLOCKED when org policy dataproc.clusterProjectScopeServiceAccountUsage is active (it restricts cluster SAs to the same project as the cluster). |
Narrative
{cluster.name} (project {cluster_project}) runs as {sa.name} from project {sa_project}; jobs executed on the cluster operate under a cross-project SA, linking the two projects in the attack graph.
Raw rule rules/derived/gcp/dataproc.yaml
id: gcp-dataproc-cross-project-trust
emits: CrossProjectTrust
description: A Dataproc cluster whose service account belongs to a different project creates a cross-project
trust; code in jobs runs as a SA from another project.
match_record:
resource_type: google.dataproc.Cluster
field: config.gceClusterConfig.serviceAccount
where:
- 'the SA''s project (parsed from SA email: sa-name@PROJECT_ID.iam.gserviceaccount.com) != the cluster''s
project'
emit:
source_type: Project
target_type: Project
source: <cluster's project>
target: <SA's home project>
permissions: []
conditions:
- role_compatibility
state_logic: ACTIVE when the cross-project SA usage is confirmed (SA email domain != cluster project).
BLOCKED when org policy dataproc.clusterProjectScopeServiceAccountUsage is active (it restricts cluster
SAs to the same project as the cluster).
derived_from:
- config.gceClusterConfig.serviceAccount cross-project SA email
false_positive_note: "Parse the SA email to determine the SA's home project. User-managed SAs follow\
\ NAME@PROJECT.iam.gserviceaccount.com; verify the PROJECT part differs from the cluster project.\
\ Default Compute Engine SAs are always same-project (format: PROJECT_NUMBER-compute@developer.gserviceaccount.com).\
\ Org policy dataproc.clusterProjectScopeServiceAccountUsage -> BLOCKED. Note that cross- project\
\ SA usage requires the SA to have been granted actAs to the actor who created the cluster \u2014\
\ not just actAs at the cluster level."
narrative: '{cluster.name} (project {cluster_project}) runs as {sa.name} from project {sa_project};
jobs executed on the cluster operate under a cross-project SA, linking the two projects in the attack
graph.'