gcp-dm-execute-as-via-update

A principal with deploymentmanager.deployments.update replaces an existing deployment's config; DM re-executes as the cloudservices SA.

derived gcp emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ServiceAccount`
source	`?principal`
target	`?sa`
permissions	`deploymentmanager.deployments.update`
conditions	`iam_permission` `api_enabled`
state logic	ACTIVE — deployments.update triggers synchronous re-actuation. Same state model as gcp-dm-execute-as-via-create. Scope: only the specific deployment the principal can update (may be narrower than all deployments in the project if deployments.setIamPolicy was used to restrict access).

source type

Identity

target type

ServiceAccount

source

?principal

target

?sa

permissions

deploymentmanager.deployments.update

conditions

iam_permission api_enabled

state logic

ACTIVE — deployments.update triggers synchronous re-actuation. Same state model as gcp-dm-execute-as-via-create. Scope: only the specific deployment the principal can update (may be narrower than all deployments in the project if deployments.setIamPolicy was used to restrict access).

Narrative

{principal.name} can update deployment {deployment.name} (deploymentmanager.deployments.update), injecting a malicious resource or accessControl section; DM re-applies the updated config as {sa.name}.

Raw rule rules/derived/gcp/deploymentmanager.yaml

id: gcp-dm-execute-as-via-update
emits: CanExecuteAs
description: A principal with deploymentmanager.deployments.update replaces an existing deployment's config;
  DM re-executes as the cloudservices SA.
match:
- - principal: null
  - CanModifyCode
  - deployment: null
- - deployment: null
  - ExecutesAs
  - sa: null
where:
- node_type(?deployment) == BuildWorker
- the CanModifyCode edge originates from gcp-dm-deployments-update (deployments.update)
emit:
  source_type: Identity
  target_type: ServiceAccount
  source: ?principal
  target: ?sa
  permissions:
  - deploymentmanager.deployments.update
  conditions:
  - iam_permission
  - api_enabled
  state_logic: "ACTIVE \u2014 deployments.update triggers synchronous re-actuation. Same state model as\
    \ gcp-dm-execute-as-via-create. Scope: only the specific deployment the principal can update (may\
    \ be narrower than all deployments in the project if deployments.setIamPolicy was used to restrict\
    \ access)."
  confidence: min(contributing_confidences) * 0.93
  derived_from:
  - gcp-dm-deployments-update (CanModifyCode edge)
  - gcp-dm-executes-as (ExecutesAs edge)
  - cicd-chains.yaml cicd-modify-buildspec-executes-as (linchpin, deduped)
  false_positive_note: .update is scoped to the specific deployment(s) the evaluator has confirmed the
    principal can write. A project-wide deployments.update grant gives access to all deployments; a per-deployment
    setIamPolicy-restricted grant is narrower. Confirm the effective scope before marking ACTIVE.
  narrative: '{principal.name} can update deployment {deployment.name} (deploymentmanager.deployments.update),
    injecting a malicious resource or accessControl section; DM re-applies the updated config as {sa.name}.'