gcp-dm-deployments-update
deploymentmanager.deployments.update allows replacing an existing deployment's config; DM re-executes as the cloudservices SA, enabling injection into an already-provisioned deployment.
match (effective permission)
{
"action": "deploymentmanager.deployments.update",
"resource_type": "google.deploymentmanager.Deployment"
}
emit
| source type | Identity |
|---|---|
| target type | BuildWorker |
| source | <principal> |
| target | <Deployment node> |
| permissions | deploymentmanager.deployments.update |
| conditions | iam_permission api_enabled |
| state logic | ACTIVE when the principal holds deployments.update on the specific deployment (or project-wide). CONDITIONAL(iam_permission) if update is restricted to a specific deployment the evaluator has not confirmed the principal can reach. BLOCKED by deny policy or VPC-SC. |
Narrative
{principal.name} can update deployment {deployment.name} (deploymentmanager.deployments.update), injecting attacker-controlled resources or accessControl bindings that DM re-applies as {sa.name}.
Raw rule rules/derived/gcp/deploymentmanager.yaml
id: gcp-dm-deployments-update
emits: CanModifyCode
description: deploymentmanager.deployments.update allows replacing an existing deployment's config; DM
re-executes as the cloudservices SA, enabling injection into an already-provisioned deployment.
match_effective_permission:
action: deploymentmanager.deployments.update
resource_type: google.deploymentmanager.Deployment
emit:
source_type: Identity
target_type: BuildWorker
source: <principal>
target: <Deployment node>
permissions:
- deploymentmanager.deployments.update
conditions:
- iam_permission
- api_enabled
state_logic: ACTIVE when the principal holds deployments.update on the specific deployment (or project-wide).
CONDITIONAL(iam_permission) if update is restricted to a specific deployment the evaluator has not
confirmed the principal can reach. BLOCKED by deny policy or VPC-SC.
confidence: 0.95
derived_from: []
false_positive_note: .update is scoped to existing deployments. An attacker must have write access to
the SPECIFIC deployment object. Project-wide deployments.update grants access to all deployments;
per-deployment IAM (deployments.setIamPolicy) can restrict it to named deployments. Confirm the scope
before emitting.
narrative: '{principal.name} can update deployment {deployment.name} (deploymentmanager.deployments.update),
injecting attacker-controlled resources or accessControl bindings that DM re-applies as {sa.name}.'