gcp-firewall-create-rule

id: gcp-firewall-create-rule
emits: CanModifyConfiguration
description: compute.firewalls.create lets an attacker insert an ALLOW rule, opening ports on any VMs
  matching a chosen tag or service account.
applies_to:
- gcp
match_effective_permission:
  action: compute.firewalls.create
  resource_type: compute.googleapis.com/Firewall
emit:
  source_type: Identity
  target_type: Firewall
  source: <principal (Identity)>
  target: <Firewall rule node (Firewall class)>
  permissions:
  - compute.firewalls.create
  conditions:
  - iam_permission
  state_logic: ACTIVE if compute.firewalls.create effective on the project; BLOCKED if constrained by
    an org policy deny.
  false_positive_note: "compute.firewalls.create alone opens a port only if the new rule wins the priority\
    \ evaluation over any existing DENY. If compute.firewalls.create is constrained to specific VPCs or\
    \ tags via IAM conditions, scope accordingly. Creating a rule with a low priority number (e.g. 500)\
    \ beats most defaults. This is not exploitation by itself \u2014 downstream CanReachPort / CanReachPort\
    \ \u2192 CanExecuteCommand requires the VM to also have an external IP or the attacker to be in-network."
  narrative: '{principal.name} can create new VPC firewall rules (compute.firewalls.create), allowing
    insertion of an ingress ALLOW rule from 0.0.0.0/0 on any port for any target tag, opening network
    access to matched VMs.'
  derived_from:
  - '<iam_permission: compute.firewalls.create on project>'
  evidence:
    narrative_template: IAM effective permission compute.firewalls.create on project {project.id} grants
      {principal.name} the ability to insert an inbound allow rule on any VPC firewall in the project.