gcp-gce-execute-as-attached-sa

Any code-exec/rebind/create primitive on a SA-bearing instance -> execute as its SA.

derived gcp emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<service account>`
permissions	`<contributing exec permission>`
conditions	`service_state` `network_reachability`
state logic	ACTIVE if CanExecuteCommand ACTIVE and ExecutesAs present and sa.privilege_level > principal.privilege_level (code on the box already runs AS the SA) else CONDITIONAL. Metadata token retrieval (optional CanRetrieveToken) is enrichment, not a gate.

source type

Identity

target type

Identity

source

<principal>

target

<service account>

permissions

<contributing exec permission>

conditions

service_state network_reachability

state logic

ACTIVE if CanExecuteCommand ACTIVE and ExecutesAs present and sa.privilege_level > principal.privilege_level (code on the box already runs AS the SA) else CONDITIONAL. Metadata token retrieval (optional CanRetrieveToken) is enrichment, not a gate.

Narrative

{principal.name} can run code on {instance.name}, which executes as {sa.name}, and read the metadata token to act with all of the SA's permissions.

Raw rule rules/derived/gcp/gce.yaml

id: gcp-gce-execute-as-attached-sa
emits: CanExecuteAs
description: Any code-exec/rebind/create primitive on a SA-bearing instance -> execute as its SA.
match:
- - principal: null
  - CanExecuteCommand
  - instance: null
- - instance: null
  - ExecutesAs
  - sa: null
where:
- ?sa.privilege_level >= ?principal.privilege_level (escalation)
optional:
- - principal: null
  - CanRetrieveToken
  - sa: null
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <service account>
  permissions:
  - <contributing exec permission>
  conditions:
  - service_state
  - network_reachability
  state_logic: ACTIVE if CanExecuteCommand ACTIVE and ExecutesAs present and sa.privilege_level > principal.privilege_level
    (code on the box already runs AS the SA) else CONDITIONAL. Metadata token retrieval (optional CanRetrieveToken)
    is enrichment, not a gate.
  false_positive_note: Only an escalation when the SA is more privileged than the principal. No SA attached
    -> not ACTIVE. Access scopes/deny may cap what the SA token can do downstream but do not negate execution-as-SA
    on the box.
  narrative: '{principal.name} can run code on {instance.name}, which executes as {sa.name}, and read
    the metadata token to act with all of the SA''s permissions.'