gcp-dm-admin
roles/deploymentmanager.admin grants full control of all DM resources - create, update, delete, and setIamPolicy on DM deployment objects.
match (effective permission)
{
"action": "deploymentmanager.deployments.setIamPolicy",
"resource_type": "google.deploymentmanager.Deployment"
}
where
principal also holds deploymentmanager.deployments.{create,update,delete}
principal also holds deploymentmanager.typeProviders.{create,update,delete}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <Deployment node> |
| permissions | deploymentmanager.deployments.create deploymentmanager.deployments.update deploymentmanager.deployments.delete deploymentmanager.deployments.setIamPolicy deploymentmanager.typeProviders.create |
| conditions | iam_permission |
| state logic | ACTIVE when the full admin permission set is confirmed. |
Narrative
{principal.name} holds roles/deploymentmanager.admin, giving full control over all DM deployments, type providers, and DM resource policies. Combined with the service agent's project-level roles, this is a complete project takeover primitive.
Raw rule rules/derived/gcp/deploymentmanager.yaml
id: gcp-dm-admin
emits: CanAdminister
description: "roles/deploymentmanager.admin grants full control of all DM resources \u2014 create, update,\
\ delete, and setIamPolicy on DM deployment objects."
match_effective_permission:
action: deploymentmanager.deployments.setIamPolicy
resource_type: google.deploymentmanager.Deployment
where:
- principal also holds deploymentmanager.deployments.{create,update,delete}
- principal also holds deploymentmanager.typeProviders.{create,update,delete}
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <Deployment node>
permissions:
- deploymentmanager.deployments.create
- deploymentmanager.deployments.update
- deploymentmanager.deployments.delete
- deploymentmanager.deployments.setIamPolicy
- deploymentmanager.typeProviders.create
conditions:
- iam_permission
state_logic: ACTIVE when the full admin permission set is confirmed.
confidence: 0.97
derived_from: []
false_positive_note: "roles/deploymentmanager.admin does not grant project-level IAM control directly\
\ \u2014 it grants full DM control. Escalation to project admin still requires the service agent's\
\ capabilities (Editor/Owner) to be exercised via a malicious deployment config."
narrative: '{principal.name} holds roles/deploymentmanager.admin, giving full control over all DM deployments,
type providers, and DM resource policies. Combined with the service agent''s project-level roles,
this is a complete project takeover primitive.'