gcp-eventarc-escalate-to-consumer-sa
CanExecuteAs on a consumer's runtime SA of strictly greater privilege than the attacker, reached via an Eventarc trigger, is privilege escalation.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?sa.privilege_level > ?principal.privilege_level
?sa is a consumer runtime SA reached via an Eventarc trigger (
CanExecuteAs derived from gcp-eventarc-execute-as-via-new-trigger or gcp-eventarc-execute-as-via-redirect)
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <consumer's runtime service account> |
| state logic | Inherits the state of the contributing CanExecuteAs edge. ACTIVE when contributing CanExecuteAs is ACTIVE. CONDITIONAL(trigger_exists) when contributing CanExecuteAs is CONDITIONAL (the typical case). POTENTIAL(role_compatibility) when actAs or invoker rights are unconfirmed. BLOCKED when contributing CanExecuteAs is BLOCKED. Never stronger than the contributing CanExecuteAs. |
Narrative
{principal.name} can escalate to {sa.name} by using Eventarc to trigger a consumer that executes as it.
Raw rule rules/derived/gcp/eventarc.yaml
id: gcp-eventarc-escalate-to-consumer-sa
emits: CanEscalateTo
description: CanExecuteAs on a consumer's runtime SA of strictly greater privilege than the attacker,
reached via an Eventarc trigger, is privilege escalation.
match:
- - principal: null
- CanExecuteAs
- sa: null
where:
- ?sa.privilege_level > ?principal.privilege_level
- ?sa is a consumer runtime SA reached via an Eventarc trigger (CanExecuteAs derived from gcp-eventarc-execute-as-via-new-trigger
or gcp-eventarc-execute-as-via-redirect)
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <consumer's runtime service account>
permissions: []
state_logic: Inherits the state of the contributing CanExecuteAs edge. ACTIVE when contributing CanExecuteAs
is ACTIVE. CONDITIONAL(trigger_exists) when contributing CanExecuteAs is CONDITIONAL (the typical
case). POTENTIAL(role_compatibility) when actAs or invoker rights are unconfirmed. BLOCKED when contributing
CanExecuteAs is BLOCKED. Never stronger than the contributing CanExecuteAs.
confidence: min(contributing_confidences) * 1.0
derived_from:
- ?principal CanExecuteAs ?sa (gcp-eventarc-execute-as-via-new-trigger or gcp-eventarc-execute-as-via-redirect)
false_positive_note: "Only emit when the consumer's runtime SA is strictly more privileged than the\
\ caller; a lateral same-privilege SA is not escalation. Inherits state from the contributing CanExecuteAs.\
\ De-dupes with can-execute-as / can-control escalation roll-ups \u2014 emit once."
narrative: '{principal.name} can escalate to {sa.name} by using Eventarc to trigger a consumer that
executes as it.'