gcp-dataproc-workflow-template-modify-code
dataproc.workflowTemplates.update lets the principal modify the job DAG (steps, jars, main class) a workflow template runs as the cluster SA.
match (effective permission)
{
"action": "dataproc.workflowTemplates.update",
"resource_type": "google.dataproc.WorkflowTemplate"
}
emit
| source type | Identity |
|---|---|
| target type | BatchJob |
| source | <principal> |
| target | <Dataproc WorkflowTemplate> |
| permissions | dataproc.workflowTemplates.update |
| conditions | iam_permission |
| state logic | CONDITIONAL(trigger_exists) when workflowTemplates.update is confirmed but no established instantiation path exists (neither a Cloud Scheduler/Pub/Sub trigger nor the attacker's own instantiate permission). Upgrade to ACTIVE when the same principal also holds dataproc.workflowTemplates.instantiate (can both modify AND run the template). BLOCKED if deny prevents the update. |
Narrative
{principal.name} can modify the job DAG of workflow template {template.name} (dataproc.workflowTemplates.update); when instantiated, the modified jobs run as the cluster SA. CITE can-execute-as execute-as-via-code-modify for the CanExecuteAs collapse.
Raw rule rules/derived/gcp/dataproc.yaml
id: gcp-dataproc-workflow-template-modify-code
emits: CanModifyCode
description: dataproc.workflowTemplates.update lets the principal modify the job DAG (steps, jars, main
class) a workflow template runs as the cluster SA.
match_effective_permission:
action: dataproc.workflowTemplates.update
resource_type: google.dataproc.WorkflowTemplate
emit:
source_type: Identity
target_type: BatchJob
source: <principal>
target: <Dataproc WorkflowTemplate>
permissions:
- dataproc.workflowTemplates.update
conditions:
- iam_permission
state_logic: CONDITIONAL(trigger_exists) when workflowTemplates.update is confirmed but no established
instantiation path exists (neither a Cloud Scheduler/Pub/Sub trigger nor the attacker's own instantiate
permission). Upgrade to ACTIVE when the same principal also holds dataproc.workflowTemplates.instantiate
(can both modify AND run the template). BLOCKED if deny prevents the update.
false_positive_note: Workflow template modification does not immediately run the template; it runs when
instantiated (dataproc.workflowTemplates.instantiate or workflowTemplates.instantiateInline). If the
attacker cannot instantiate and no existing trigger does so, state is CONDITIONAL(trigger_exists).
CITE can-execute-as execute-as-via-code-modify + cicd-chains cicd-modify-buildspec-executes-as for
the CanExecuteAs collapse. The cluster the workflow targets must also have an ExecutesAs edge to the
cluster SA.
narrative: '{principal.name} can modify the job DAG of workflow template {template.name} (dataproc.workflowTemplates.update);
when instantiated, the modified jobs run as the cluster SA. CITE can-execute-as execute-as-via-code-modify
for the CanExecuteAs collapse.'