gcp-datastream-create-private-conn-network-reach
datastream.privateConnections.create lets a principal establish a VPC peering from the Datastream service network to an attacker-controlled VPC or a sensitive customer network, enabling network reach for probing or bridging boundaries.
match (effective permission)
{
"action": "datastream.privateConnections.create",
"resource_type": "google.datastream.Location"
}
emit
| source type | Identity |
|---|---|
| target type | Network |
| source | <principal> |
| target | <attacker-controlled VPC or sensitive customer network> |
| permissions | datastream.privateConnections.create |
| conditions | iam_permission api_enabled peering_acceptance |
| state logic | ACTIVE if datastream.privateConnections.create is confirmed AND the principal controls or can influence the target VPC (either owns it or the attacker can provision infrastructure in it). CONDITIONAL(peering_acceptance) if the VPC peering request requires acceptance by the target VPC owner — if the attacker does not control the target VPC, the peering remains pending and the attack is CONDITIONAL on the peer accepting the peering request. BLOCKED if a deny policy applies to datastream.privateConnections.create or if an org policy restricts VPC peering. |
Narrative
{principal.name} can create a Datastream PrivateConnection (datastream.privateConnections.create) that peers the Datastream service network into an attacker-controlled VPC or a sensitive customer network. This enables the attacker to probe or bridge network boundaries, reach private databases, or pivot into on-premises systems via VPN/Interconnect.
Raw rule rules/derived/gcp/datastream.yaml
id: gcp-datastream-create-private-conn-network-reach
emits: CanNetworkReach
description: datastream.privateConnections.create lets a principal establish a VPC peering from the Datastream
service network to an attacker-controlled VPC or a sensitive customer network, enabling network reach
for probing or bridging boundaries.
match_effective_permission:
action: datastream.privateConnections.create
resource_type: google.datastream.Location
emit:
source_type: Identity
target_type: Network
source: <principal>
target: <attacker-controlled VPC or sensitive customer network>
permissions:
- datastream.privateConnections.create
conditions:
- iam_permission
- api_enabled
- peering_acceptance
state_logic: "ACTIVE if datastream.privateConnections.create is confirmed AND the principal controls\
\ or can influence the target VPC (either owns it or the attacker can provision infrastructure in\
\ it). CONDITIONAL(peering_acceptance) if the VPC peering request requires acceptance by the target\
\ VPC owner \u2014 if the attacker does not control the target VPC, the peering remains pending and\
\ the attack is CONDITIONAL on the peer accepting the peering request. BLOCKED if a deny policy applies\
\ to datastream.privateConnections.create or if an org policy restricts VPC peering."
confidence: 0.8
derived_from:
- <datastream.privateConnections.create effective permission on principal>
false_positive_note: 'VPC peering is bidirectional but asymmetric: the initiator (Datastream) can reach
the target VPC if the peering is CREATED, but the target VPC does not automatically reach back into
the Datastream service network (depends on target VPC routing). The attack requires either (a) attacker-controlled
target VPC to accept the peering and bridge into sensitive networks, or (b) compromise of the target
VPC owner to accept the peering request. If the peering request is rejected, the network reach is
not achieved. VPC peering quotas and org policies may also block peering creation.'
narrative: '{principal.name} can create a Datastream PrivateConnection (datastream.privateConnections.create)
that peers the Datastream service network into an attacker-controlled VPC or a sensitive customer
network. This enables the attacker to probe or bridge network boundaries, reach private databases,
or pivot into on-premises systems via VPN/Interconnect.'