gcp-firewall-update-rule
compute.firewalls.update lets an attacker widen an existing rule to 0.0.0.0/0 source or add new ports.
match (effective permission)
{
"action": "compute.firewalls.update",
"resource_type": "compute.googleapis.com/Firewall"
}
emit
| source type | Identity |
|---|---|
| target type | Firewall |
| source | <principal (Identity)> |
| target | <Firewall rule node (Firewall class)> |
| permissions | compute.firewalls.update |
| conditions | iam_permission |
| state logic | ACTIVE if compute.firewalls.update effective on the specific firewall rule or the project; BLOCKED if IAM condition restricts to a label/tag that does not match. |
Narrative
{principal.name} can update existing VPC firewall rules (compute.firewalls.update), including widening the source range to 0.0.0.0/0 or adding new allowed protocols and ports, weakening network isolation for targeted VMs.
Raw rule rules/derived/gcp/firewall.yaml
id: gcp-firewall-update-rule
emits: CanModifyConfiguration
description: compute.firewalls.update lets an attacker widen an existing rule to 0.0.0.0/0 source or add
new ports.
applies_to:
- gcp
match_effective_permission:
action: compute.firewalls.update
resource_type: compute.googleapis.com/Firewall
emit:
source_type: Identity
target_type: Firewall
source: <principal (Identity)>
target: <Firewall rule node (Firewall class)>
permissions:
- compute.firewalls.update
conditions:
- iam_permission
state_logic: ACTIVE if compute.firewalls.update effective on the specific firewall rule or the project;
BLOCKED if IAM condition restricts to a label/tag that does not match.
false_positive_note: compute.firewalls.update on a DENY rule widening source ranges is unusual but possible.
The target rule must be an ALLOW rule for port-opening abuse; updating a DENY rule's source to 0.0.0.0/0
is destructive (blocks everyone) not an opening. Emit for ALLOW-direction rules.
narrative: '{principal.name} can update existing VPC firewall rules (compute.firewalls.update), including
widening the source range to 0.0.0.0/0 or adding new allowed protocols and ports, weakening network
isolation for targeted VMs.'
derived_from:
- '<iam_permission: compute.firewalls.update on Firewall node>'
evidence:
narrative_template: IAM effective permission compute.firewalls.update on {target.name} grants {principal.name}
the ability to modify the rule's source ranges and allowed protocol/port combinations.