gcp-firewall-delete-deny-rule
compute.firewalls.delete on a DENY rule lets an attacker unblock previously denied traffic, opening network access to matched VMs.
match (effective permission)
{
"action": "compute.firewalls.delete",
"resource_type": "compute.googleapis.com/Firewall"
}
emit
| source type | Identity |
|---|---|
| target type | Firewall |
| source | <principal (Identity)> |
| target | <Firewall rule node (Firewall class), specifically a DENY rule> |
| permissions | compute.firewalls.delete |
| conditions | iam_permission |
| state logic | ACTIVE if compute.firewalls.delete effective on the DENY firewall rule and the rule is the effective blocking rule for the target (target-tag/SA, protocol+port, source-range) tuple. CONDITIONAL(resource_configuration) if the DENY is not the highest-priority rule blocking that tuple (a lower-priority-number DENY would still block even after deletion). BLOCKED if a lower-priority-number DENY overrides this deletion. |
Narrative
{principal.name} can delete VPC firewall rule {target.name} (compute.firewalls.delete). Since this is a DENY rule blocking ingress from {source_range} on {protocol}/{port}, deletion unblocks traffic that was previously denied, weakening network isolation for the matched VMs.
Raw rule rules/derived/gcp/firewall.yaml
id: gcp-firewall-delete-deny-rule
emits: CanModifyConfiguration
description: compute.firewalls.delete on a DENY rule lets an attacker unblock previously denied traffic,
opening network access to matched VMs.
applies_to:
- gcp
match_effective_permission:
action: compute.firewalls.delete
resource_type: compute.googleapis.com/Firewall
emit:
source_type: Identity
target_type: Firewall
source: <principal (Identity)>
target: <Firewall rule node (Firewall class), specifically a DENY rule>
permissions:
- compute.firewalls.delete
conditions:
- iam_permission
state_logic: ACTIVE if compute.firewalls.delete effective on the DENY firewall rule and the rule is
the effective blocking rule for the target (target-tag/SA, protocol+port, source-range) tuple. CONDITIONAL(resource_configuration)
if the DENY is not the highest-priority rule blocking that tuple (a lower-priority-number DENY would
still block even after deletion). BLOCKED if a lower-priority-number DENY overrides this deletion.
false_positive_note: "Deleting an ALLOW rule is destructive but not an escalation \u2014 omit CanModifyConfiguration\
\ for ALLOW deletion. Only emit for DENY rules. The rule must be the effective blocking rule for the\
\ (target, port, source) tuple. If a higher-priority DENY (lower priority number) would still block\
\ traffic even after this DENY is deleted, reduce confidence and mark CONDITIONAL(resource_configuration)\
\ \u2014 the impact is mitigated. Verify the firewall rule's direction=DENY and action=DENY before\
\ emitting."
narrative: '{principal.name} can delete VPC firewall rule {target.name} (compute.firewalls.delete).
Since this is a DENY rule blocking ingress from {source_range} on {protocol}/{port}, deletion unblocks
traffic that was previously denied, weakening network isolation for the matched VMs.'
derived_from:
- '<iam_permission: compute.firewalls.delete on Firewall node>'
evidence:
narrative_template: IAM effective permission compute.firewalls.delete on {target.name} grants {principal.name}
the ability to delete this DENY firewall rule. The rule has direction=DENY, action=DENY, and blocks
ingress from {source_range} on {protocol}/{port}. Deletion would unblock that traffic.