gcp-dm-deployments-create
deploymentmanager.deployments.create allows submitting a new deployment config; DM executes it as the cloudservices service agent. This is the CI/CD CanModifyCode primitive for DM.
match (effective permission)
{
"action": "deploymentmanager.deployments.create",
"resource_type": "google.deploymentmanager.Deployment"
}
emit
| source type | Identity |
|---|---|
| target type | BuildWorker |
| source | <principal> |
| target | <Deployment node (new or existing project-scoped)> |
| permissions | deploymentmanager.deployments.create |
| conditions | iam_permission api_enabled |
| state logic | ACTIVE when the principal holds the effective permission at project scope and the Deployment Manager API is enabled. BLOCKED if an IAM deny policy denies deploymentmanager.deployments.create, an org policy restricts DM usage, or a VPC Service Controls perimeter prevents the DM API call. |
Narrative
{principal.name} can create a Deployment Manager deployment (deploymentmanager.deployments.create), submitting an attacker-controlled config that DM executes as the Google APIs service agent {sa.name}. Any GCP resource or IAM policy the service agent can manage can be provisioned or manipulated by this config.
Raw rule rules/derived/gcp/deploymentmanager.yaml
id: gcp-dm-deployments-create
emits: CanModifyCode
description: deploymentmanager.deployments.create allows submitting a new deployment config; DM executes
it as the cloudservices service agent. This is the CI/CD CanModifyCode primitive for DM.
match_effective_permission:
action: deploymentmanager.deployments.create
resource_type: google.deploymentmanager.Deployment
emit:
source_type: Identity
target_type: BuildWorker
source: <principal>
target: <Deployment node (new or existing project-scoped)>
permissions:
- deploymentmanager.deployments.create
conditions:
- iam_permission
- api_enabled
state_logic: ACTIVE when the principal holds the effective permission at project scope and the Deployment
Manager API is enabled. BLOCKED if an IAM deny policy denies deploymentmanager.deployments.create,
an org policy restricts DM usage, or a VPC Service Controls perimeter prevents the DM API call.
confidence: 0.97
derived_from: []
false_positive_note: deployments.create alone is the code-injection gate; the downstream escalation
(CanExecuteAs, CanGrantPermission) depends on the service agent's actual effective permissions. If
the service agent was stripped of roles/editor (via org policy or manual removal), the escalation
surface shrinks to whatever roles it does hold. Always resolve sa.effective_roles before asserting
privilege escalation strength.
narrative: '{principal.name} can create a Deployment Manager deployment (deploymentmanager.deployments.create),
submitting an attacker-controlled config that DM executes as the Google APIs service agent {sa.name}.
Any GCP resource or IAM policy the service agent can manage can be provisioned or manipulated by this
config.'