gcp-firewall-policy-update

id: gcp-firewall-policy-update
emits: CanModifyConfiguration
description: compute.firewallPolicies.update on a hierarchical/network policy lets an attacker insert
  ALLOW rules affecting all projects in the policy scope.
applies_to:
- gcp
match_effective_permission:
  action: compute.firewallPolicies.update
  resource_type: compute.googleapis.com/FirewallPolicy
emit:
  source_type: Identity
  target_type: Firewall
  source: <principal (Identity)>
  target: <Firewall policy node (Firewall class)>
  permissions:
  - compute.firewallPolicies.update
  conditions:
  - iam_permission
  state_logic: ACTIVE if compute.firewallPolicies.update effective on the policy resource; CONDITIONAL(scp_or_org_policy)
    if an org policy restricts firewall policy modification.
  false_positive_note: "compute.firewallPolicies.update modifies the policy rules but the policy must\
    \ be ASSOCIATED (attached) to a folder/org/network to have effect. If the policy is not attached to\
    \ any node, this is POTENTIAL rather than ACTIVE for any specific VM exposure. Check the FirewallPolicy\
    \ resource's associations field (policy.associations[].attachmentTarget) to determine whether the\
    \ policy is bound to org/folder/network nodes. Hierarchical policies at higher priority override VPC\
    \ rules \u2014 honor the priority / GOTO-NEXT evaluation semantics; an ALLOW in a hierarchical policy\
    \ does not override a lower-priority-number DENY in the same policy."
  narrative: '{principal.name} can modify hierarchical or network firewall policy {target.name} (compute.firewallPolicies.update),
    inserting ALLOW rules that apply to all networks / projects the policy is associated with, potentially
    opening ports across the entire folder or organization scope.'
  derived_from:
  - '<iam_permission: compute.firewallPolicies.update on policy>'
  evidence:
    narrative_template: IAM effective permission compute.firewallPolicies.update on policy {target.name}
      grants {principal.name} the ability to insert or modify rules in a policy that may govern network
      access across multiple projects.