rage.fail

gcp-firewall-can-modify-config-update

explicit gcp emits CanModifyConfiguration

match (effective permission)

{ "action": "compute.firewalls.update", "resource_type": "compute.googleapis.com/Firewall" }

emit

source type	`Identity`
target type	`Firewall`
source	`<principal (Identity)>`
target	`<Firewall rule node (Firewall class)>`
permissions	`compute.firewalls.update`

Narrative

{principal.name} can update existing VPC firewall rule {target.name} (compute.firewalls.update), including widening source ranges to 0.0.0.0/0 or adding new allowed protocols and ports, weakening network isolation for the rule's targeted VMs.

Raw rule rules/explicit/gcp-firewall.yaml

id: gcp-firewall-can-modify-config-update
emits: CanModifyConfiguration
applies_to:
- gcp
match_effective_permission:
  action: compute.firewalls.update
  resource_type: compute.googleapis.com/Firewall
emit:
  source_type: Identity
  target_type: Firewall
  source: <principal (Identity)>
  target: <Firewall rule node (Firewall class)>
  permissions:
  - compute.firewalls.update
  narrative: '{principal.name} can update existing VPC firewall rule {target.name} (compute.firewalls.update),
    including widening source ranges to 0.0.0.0/0 or adding new allowed protocols and ports, weakening
    network isolation for the rule''s targeted VMs.'