gcp-deploy-exec-sa-can-deploy-gke

The Cloud Deploy execution SA's GKE deployment permissions (container.developer) give it CanDeploy to a GKE cluster.

derived gcp emits CanDeploy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`ServiceAccount`
target type	`ContainerCluster`
source	`?exec_sa`
target	`?gke_cluster`
permissions	`container.pods.create` `container.pods.update` `container.clusters.get`
conditions	`iam_permission`
state logic	ACTIVE when the SA's effective container.developer (or equivalent) permissions on the GKE cluster are confirmed. CONDITIONAL(iam_permission) when permissions are unconfirmed. This edge feeds container-chains image-push-poisons-consumers (if the SA can also push images to the registry) and can-execute-as execute-as-via-command (if the SA can exec into pods).

source type

ServiceAccount

target type

ContainerCluster

source

?exec_sa

target

?gke_cluster

permissions

container.pods.create container.pods.update container.clusters.get

conditions

iam_permission

state logic

ACTIVE when the SA's effective container.developer (or equivalent) permissions on the GKE cluster are confirmed. CONDITIONAL(iam_permission) when permissions are unconfirmed. This edge feeds container-chains image-push-poisons-consumers (if the SA can also push images to the registry) and can-execute-as execute-as-via-command (if the SA can exec into pods).

Narrative

Cloud Deploy execution SA {exec_sa.name} holds GKE deployment permissions on cluster {gke_cluster.name} (container.developer or equivalent), giving it CanDeploy to that cluster. An attacker who executes as {exec_sa.name} (via release/rollout creation) can deploy arbitrary workloads to {gke_cluster.name}.

Raw rule rules/derived/gcp/clouddeploy.yaml

id: gcp-deploy-exec-sa-can-deploy-gke
emits: CanDeploy
description: The Cloud Deploy execution SA's GKE deployment permissions (container.developer) give it
  CanDeploy to a GKE cluster.
applies_to:
- gcp
match:
- - exec_sa: null
  - HasPermission
  - gke_cluster: null
where:
- ?exec_sa is the Cloud Deploy execution SA for a delivery pipeline target
- ?gke_cluster is a GKE cluster (KubernetesCluster) the target deploys to
- ?exec_sa has effective container.clusters.get + container.pods.create/update/delete on ?gke_cluster
emit:
  source_type: ServiceAccount
  target_type: ContainerCluster
  source: ?exec_sa
  target: ?gke_cluster
  permissions:
  - container.pods.create
  - container.pods.update
  - container.clusters.get
  conditions:
  - iam_permission
  state_logic: ACTIVE when the SA's effective container.developer (or equivalent) permissions on the GKE
    cluster are confirmed. CONDITIONAL(iam_permission) when permissions are unconfirmed. This edge feeds
    container-chains image-push-poisons-consumers (if the SA can also push images to the registry) and
    can-execute-as execute-as-via-command (if the SA can exec into pods).
  confidence: 0.9
  derived_from:
  - ?exec_sa HasPermission ?gke_cluster (GCP IAM effective permission)
  - gcp-deploy-executes-as
  false_positive_note: "Validate the SA's effective permissions on the SPECIFIC cluster, not just project\
    \ level. A SA with container.developer project-wide can deploy to ALL GKE clusters \u2014 record the\
    \ widest reachable scope. An attacker who executes as {exec_sa.name} (via release/rollout creation)\
    \ can then deploy/modify workloads on this cluster."
  narrative: Cloud Deploy execution SA {exec_sa.name} holds GKE deployment permissions on cluster {gke_cluster.name}
    (container.developer or equivalent), giving it CanDeploy to that cluster. An attacker who executes
    as {exec_sa.name} (via release/rollout creation) can deploy arbitrary workloads to {gke_cluster.name}.