rage.fail

gcp-firewall-policy-can-modify-config

explicit gcp emits CanModifyConfiguration

match (effective permission)

{ "action": "compute.firewallPolicies.update", "resource_type": "compute.googleapis.com/FirewallPolicy" }

emit

source type	`Identity`
target type	`Firewall`
source	`<principal (Identity)>`
target	`<Firewall policy node (Firewall class)>`
permissions	`compute.firewallPolicies.update`

Narrative

{principal.name} can modify hierarchical or network firewall policy {target.name} (compute.firewallPolicies.update), potentially inserting ALLOW rules with folder- or organization-wide scope, weakening network isolation across all associated projects.

Raw rule rules/explicit/gcp-firewall.yaml

id: gcp-firewall-policy-can-modify-config
emits: CanModifyConfiguration
applies_to:
- gcp
match_effective_permission:
  action: compute.firewallPolicies.update
  resource_type: compute.googleapis.com/FirewallPolicy
emit:
  source_type: Identity
  target_type: Firewall
  source: <principal (Identity)>
  target: <Firewall policy node (Firewall class)>
  permissions:
  - compute.firewallPolicies.update
  narrative: '{principal.name} can modify hierarchical or network firewall policy {target.name} (compute.firewallPolicies.update),
    potentially inserting ALLOW rules with folder- or organization-wide scope, weakening network isolation
    across all associated projects.'