gcp-firestore-set-iam-policy
datastore.databases.setIamPolicy writes the Firestore database IAM allow policy; the caller can grant any principal (including itself) any role on the database.
match (effective permission)
{
"action": "datastore.databases.setIamPolicy",
"resource_type": "google.firestore.Database"
}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <database ResourcePolicy node> |
| permissions | datastore.databases.setIamPolicy |
| conditions | iam_permission |
| state logic | ACTIVE when datastore.databases.setIamPolicy is confirmed effective on the Firestore Database or at project scope (project-level role includes all databases) and no IAM deny policy or org policy blocks the action; BLOCKED under IAM deny policy denying setIamPolicy or VPC-SC perimeter denial. |
Narrative
{principal.name} holds datastore.databases.setIamPolicy on {database.name} and can overwrite its IAM policy - granting itself or any principal read/write/ admin access to all Firestore documents.
Raw rule rules/derived/gcp/firestore.yaml
id: gcp-firestore-set-iam-policy
emits: CanModifyPolicy
description: datastore.databases.setIamPolicy writes the Firestore database IAM allow policy; the caller
can grant any principal (including itself) any role on the database.
match_effective_permission:
action: datastore.databases.setIamPolicy
resource_type: google.firestore.Database
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <database ResourcePolicy node>
permissions:
- datastore.databases.setIamPolicy
conditions:
- iam_permission
state_logic: ACTIVE when datastore.databases.setIamPolicy is confirmed effective on the Firestore Database
or at project scope (project-level role includes all databases) and no IAM deny policy or org policy
blocks the action; BLOCKED under IAM deny policy denying setIamPolicy or VPC-SC perimeter denial.
confidence: min(contributing_confidences) * 0.97
derived_from:
- datastore.databases.setIamPolicy effective permission on Firestore Database
false_positive_note: "setIamPolicy allows full IAM policy replacement on the database resource. The\
\ caller can bind any principal to roles/datastore.owner, roles/datastore.viewer, or custom roles.\
\ In Firestore multi-database projects, setIamPolicy at the database level covers that specific database;\
\ at the project level, it covers all databases. Downstream exposure edges (CanGrantPermission, CrossProjectTrust)\
\ are emitted by specific rules below. Note: setIamPolicy on the Firestore DATABASE resource is distinct\
\ from the project-level resourcemanager.projects.setIamPolicy \u2014 the former covers Firestore\
\ data access only; the latter covers the entire project's IAM. Do not conflate them."
narrative: "{principal.name} holds datastore.databases.setIamPolicy on {database.name} and can overwrite\
\ its IAM policy \u2014 granting itself or any principal read/write/ admin access to all Firestore\
\ documents."