gcp-dataproc-workflow-template-instantiate
dataproc.workflowTemplates.instantiate directly runs the workflow template, feeding cicd-chains trigger-then-executes-as.
match (effective permission)
{
"action": "dataproc.workflowTemplates.instantiate",
"resource_type": "google.dataproc.WorkflowTemplate"
}
emit
| source type | Identity |
|---|---|
| target type | BatchJob |
| source | <principal> |
| target | <Dataproc WorkflowTemplate> |
| permissions | dataproc.workflowTemplates.instantiate |
| conditions | iam_permission |
| state logic | ACTIVE when the effective permission is confirmed. BLOCKED if deny prevents it. This CanTrigger feeds cicd-chains cicd-trigger-runner-executes-as: CONDITIONAL(attacker_influenced_definition) — triggering runs the CURRENT template; it is only a CanExecuteAs pivot if the current definition is attacker- influenced (the principal also holds workflowTemplates.update -> ACTIVE via can-execute-as; otherwise CONDITIONAL). |
Narrative
{principal.name} can instantiate workflow template {template.name} (dataproc.workflowTemplates.instantiate); this runs the current job DAG on the attached cluster SA.
Raw rule rules/derived/gcp/dataproc.yaml
id: gcp-dataproc-workflow-template-instantiate
emits: CanTrigger
description: dataproc.workflowTemplates.instantiate directly runs the workflow template, feeding cicd-chains
trigger-then-executes-as.
match_effective_permission:
action: dataproc.workflowTemplates.instantiate
resource_type: google.dataproc.WorkflowTemplate
emit:
source_type: Identity
target_type: BatchJob
source: <principal>
target: <Dataproc WorkflowTemplate>
permissions:
- dataproc.workflowTemplates.instantiate
conditions:
- iam_permission
state_logic: "ACTIVE when the effective permission is confirmed. BLOCKED if deny prevents it. This CanTrigger\
\ feeds cicd-chains cicd-trigger-runner-executes-as: CONDITIONAL(attacker_influenced_definition) \u2014\
\ triggering runs the CURRENT template; it is only a CanExecuteAs pivot if the current definition\
\ is attacker- influenced (the principal also holds workflowTemplates.update -> ACTIVE via can-execute-as;\
\ otherwise CONDITIONAL)."
false_positive_note: "Triggering a workflow template alone is CONDITIONAL \u2014 the current job DAG\
\ must already contain attacker-controlled code for this to be a meaningful execution pivot. Cite\
\ cicd-chains cicd-trigger-runner-executes-as (CONDITIONAL by default) rather than asserting ACTIVE\
\ unless the template definition is also attacker-controlled."
narrative: '{principal.name} can instantiate workflow template {template.name} (dataproc.workflowTemplates.instantiate);
this runs the current job DAG on the attached cluster SA.'