rage.fail

gcp-execute-as-via-actas

actAs + ability to create a resource that runs as the SA.

derived gcp emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'sa': None}

where

?principal has a create/deploy action in {compute.instances.create, cloudfunctions.functions.create, run.services.create, cloudbuild.builds.create, composer/dataflow/dataproc create}

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<service account>`
permissions	`iam.serviceAccounts.actAs` `<service create action>`

Narrative

{principal.name} can actAs {sa.name} and deploy a workload, executing code with the SA's permissions.

Raw rule rules/derived/gcp/identity-escalation.yaml

id: gcp-execute-as-via-actas
emits: CanExecuteAs
description: actAs + ability to create a resource that runs as the SA.
match:
- - principal: null
  - CanPassIdentity
  - sa: null
where:
- ?principal has a create/deploy action in {compute.instances.create, cloudfunctions.functions.create,
  run.services.create, cloudbuild.builds.create, composer/dataflow/dataproc create}
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <service account>
  permissions:
  - iam.serviceAccounts.actAs
  - <service create action>
  escalation: Deploy a workload bound to a privileged SA and run code as it.
  narrative: '{principal.name} can actAs {sa.name} and deploy a workload, executing code with the SA''s
    permissions.'