gcp-deploy-policy-override
clouddeploy.deployPolicies.override bypasses a Cloud Deploy time-window restriction, enabling rollouts during governance freeze windows.
match (effective permission)
{
"action": "clouddeploy.deployPolicies.override",
"resource_type": "google.cloud.deploy.DeployPolicy"
}
emit
| source type | Identity |
|---|---|
| target type | GenericPolicy |
| source | <principal> |
| target | <Cloud Deploy deploy policy> |
| permissions | clouddeploy.deployPolicies.override |
| state logic | ACTIVE when the principal holds effective clouddeploy.deployPolicies.override. The override is an operational bypass, not a structural policy change — it does not modify the policy definition, only the enforcement at call time. Combined with a rollout edge that is CONDITIONAL(time_window), this override upgrades that rollout edge to ACTIVE by satisfying the time_window condition. BLOCKED when an IAM deny policy denies clouddeploy.deployPolicies.override. |
Narrative
{principal.name} holds clouddeploy.deployPolicies.override and can bypass the time-window restriction of deploy policy {policy.name}, enabling rollout actions (promote, advance, approve) during a governance freeze window. This upgrades a CONDITIONAL(time_window) rollout edge to ACTIVE.
Raw rule rules/derived/gcp/clouddeploy.yaml
id: gcp-deploy-policy-override
emits: CanModifyPolicy
description: clouddeploy.deployPolicies.override bypasses a Cloud Deploy time-window restriction, enabling
rollouts during governance freeze windows.
applies_to:
- gcp
match_effective_permission:
action: clouddeploy.deployPolicies.override
resource_type: google.cloud.deploy.DeployPolicy
emit:
source_type: Identity
target_type: GenericPolicy
source: <principal>
target: <Cloud Deploy deploy policy>
permissions:
- clouddeploy.deployPolicies.override
state_logic: "ACTIVE when the principal holds effective clouddeploy.deployPolicies.override. The override\
\ is an operational bypass, not a structural policy change \u2014 it does not modify the policy definition,\
\ only the enforcement at call time. Combined with a rollout edge that is CONDITIONAL(time_window),\
\ this override upgrades that rollout edge to ACTIVE by satisfying the time_window condition. BLOCKED\
\ when an IAM deny policy denies clouddeploy.deployPolicies.override."
confidence: 0.9
derived_from:
- clouddeploy.deployPolicies.override effective permission
false_positive_note: "Emit CanModifyPolicy on the policy node (not CanDelete or CanAdminister \u2014\
\ this is a call-time bypass, not a persistent mutation of the policy resource). The override applies\
\ per-call with --override-deploy-policies flag; it does not permanently disable the policy. Do not\
\ treat this as a BLOCKED-edge removal; instead mark the gated rollout edge as CONDITIONAL(time_window)\
\ and note that an actor with this override permission can satisfy that condition."
narrative: '{principal.name} holds clouddeploy.deployPolicies.override and can bypass the time-window
restriction of deploy policy {policy.name}, enabling rollout actions (promote, advance, approve) during
a governance freeze window. This upgrades a CONDITIONAL(time_window) rollout edge to ACTIVE.'