rage.fail

gcp-firewall-can-modify-config-create

explicit gcp emits CanModifyConfiguration

match (effective permission)

{ "action": "compute.firewalls.create", "resource_type": "compute.googleapis.com/Firewall" }

emit

source type	`Identity`
target type	`Firewall`
source	`<principal (Identity)>`
target	`<project-scoped Firewall capability node>`
permissions	`compute.firewalls.create`

Narrative

{principal.name} can create new VPC firewall rules (compute.firewalls.create) in the project, enabling insertion of ingress ALLOW rules from 0.0.0.0/0 on any port for any target tag - weakening network isolation for matched VMs.

Raw rule rules/explicit/gcp-firewall.yaml

id: gcp-firewall-can-modify-config-create
emits: CanModifyConfiguration
applies_to:
- gcp
match_effective_permission:
  action: compute.firewalls.create
  resource_type: compute.googleapis.com/Firewall
emit:
  source_type: Identity
  target_type: Firewall
  source: <principal (Identity)>
  target: <project-scoped Firewall capability node>
  permissions:
  - compute.firewalls.create
  narrative: "{principal.name} can create new VPC firewall rules (compute.firewalls.create) in the project,\
    \ enabling insertion of ingress ALLOW rules from 0.0.0.0/0 on any port for any target tag \u2014 weakening\
    \ network isolation for matched VMs."