gcp-dm-deployments-config
deploymentmanager.deployments.stop / cancelPreview allows aborting or modifying deployment state without full resource creation.
match (effective permission)
{
"action": "deploymentmanager.deployments.stop",
"resource_type": "google.deploymentmanager.Deployment"
}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <Deployment node> |
| permissions | deploymentmanager.deployments.stop deploymentmanager.deployments.cancelPreview |
| conditions | iam_permission |
| state logic | ACTIVE. These are disruption/state-change actions, not code execution. By themselves they do not yield CanExecuteAs; they are useful for sabotage or forcing a deployment into a state another action exploits. |
Narrative
{principal.name} can stop or cancel a DM deployment preview ({deployment.name}), disrupting deployment state without creating resources. Not a direct code-execution path.
Raw rule rules/derived/gcp/deploymentmanager.yaml
id: gcp-dm-deployments-config
emits: CanModifyConfiguration
description: deploymentmanager.deployments.stop / cancelPreview allows aborting or modifying deployment
state without full resource creation.
match_effective_permission:
action: deploymentmanager.deployments.stop
resource_type: google.deploymentmanager.Deployment
alt_permission: deploymentmanager.deployments.cancelPreview
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <Deployment node>
permissions:
- deploymentmanager.deployments.stop
- deploymentmanager.deployments.cancelPreview
conditions:
- iam_permission
state_logic: ACTIVE. These are disruption/state-change actions, not code execution. By themselves they
do not yield CanExecuteAs; they are useful for sabotage or forcing a deployment into a state another
action exploits.
confidence: 0.6
derived_from: []
false_positive_note: stop/cancelPreview do NOT execute attacker code. Do not chain to CanExecuteAs derivations.
Emit as CanModifyConfiguration only, with a low confidence reflecting the indirect/sabotage nature.
narrative: '{principal.name} can stop or cancel a DM deployment preview ({deployment.name}), disrupting
deployment state without creating resources. Not a direct code-execution path.'