gcp-deploy-pipeline-set-iam-policy

id: gcp-deploy-pipeline-set-iam-policy
emits: CanModifyPolicy
description: clouddeploy.deliveryPipelines.setIamPolicy lets the principal modify the pipeline's IAM policy,
  granting itself releases.create / rollouts.create.
applies_to:
- gcp
match_effective_permission:
  action: clouddeploy.deliveryPipelines.setIamPolicy
  resource_type: google.cloud.deploy.DeliveryPipeline
emit:
  source_type: Identity
  target_type: Policy
  source: <principal>
  target: <delivery pipeline IAM policy>
  permissions:
  - clouddeploy.deliveryPipelines.setIamPolicy
  state_logic: ACTIVE when the principal holds effective clouddeploy.deliveryPipelines.setIamPolicy. BLOCKED
    when an IAM deny policy denies this action. can-control control-boundary-via-iam-admin can roll this
    up to Controls(pipeline) if desired.
  confidence: 0.95
  derived_from:
  - clouddeploy.deliveryPipelines.setIamPolicy effective permission
  false_positive_note: 'setIamPolicy on the pipeline allows granting pipeline-scoped roles only; it does
    not grant project-level roles/editor or roles on the execution SA. The escalation requires: (1) self-grant
    releases.create / rollouts.create on the pipeline, then (2) separately actAs on the execution SA (project-level
    grant). If the attacker lacks the actAs grant, pipeline setIamPolicy alone yields no execution-as.
    Model as CanModifyPolicy on the pipeline''s IAM policy (not CanGrantPermission on a principal).'
  narrative: "{principal.name} can set the IAM policy of delivery pipeline {pipeline.name} (clouddeploy.deliveryPipelines.setIamPolicy),\
    \ modifying who can grant itself or others clouddeploy.releases.create / clouddeploy.rollouts.create\
    \ \u2014 the entry points for executing as the pipeline's execution SA."