rage.fail

gcp-gce-create-instance-as-sa

actAs + compute.instances.create -> launch instance as the SA, read metadata token.

derived gcp emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'sa': None}

where

?principal has EFFECTIVE compute.instances.create ?principal has compute.disks.create and compute.subnetworks.use (boot disk + network placement) ?sa is actAs-able by ?principal (iam.serviceAccounts.actAs)

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<service account>`
permissions	`compute.instances.create` `compute.disks.create` `compute.subnetworks.use` `iam.serviceAccounts.actAs`
conditions	`iam_permission` `role_compatibility`

Narrative

{principal.name} can create a new instance bound to {sa.name} (compute.instances.create + iam.serviceAccounts.actAs) and read the metadata server to obtain the SA's token.

Raw rule rules/derived/gcp/gce.yaml

id: gcp-gce-create-instance-as-sa
emits: CanCreateWorkloadAs
description: actAs + compute.instances.create -> launch instance as the SA, read metadata token.
match:
- - principal: null
  - CanPassIdentity
  - sa: null
where:
- ?principal has EFFECTIVE compute.instances.create
- ?principal has compute.disks.create and compute.subnetworks.use (boot disk + network placement)
- ?sa is actAs-able by ?principal (iam.serviceAccounts.actAs)
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <service account>
  permissions:
  - compute.instances.create
  - compute.disks.create
  - compute.subnetworks.use
  - iam.serviceAccounts.actAs
  conditions:
  - iam_permission
  - role_compatibility
  escalation: Launch an instance bound to a privileged SA, then read the metadata server for its OAuth
    token.
  false_positive_note: compute.instances.create alone is not SA execution; it must be paired with iam.serviceAccounts.actAs
    on the chosen SA. Access scopes on the new instance can cap the token.
  narrative: '{principal.name} can create a new instance bound to {sa.name} (compute.instances.create
    + iam.serviceAccounts.actAs) and read the metadata server to obtain the SA''s token.'