gcp-gce-image-poison
Create a poisoned image/machine-image that future instances/templates boot from (supply chain).
match (effective permission)
{
"action": "compute.images.create",
"resource_type": "compute.googleapis.com/Image"
}
where
the poisoned image/machine-image is (or will be) referenced by an instance template / MIG / future instance launch
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <image / machine-image (code supply for future launches)> |
| permissions | compute.images.create compute.machineImages.create |
| conditions | iam_permission trigger_exists |
| state logic | CONDITIONAL(trigger_exists) -- realized only when a future instance/template/MIG launch boots from the poisoned image; creating the image alone is not execution. |
Narrative
{principal.name} can create a poisoned image/machine-image (compute.images.create / compute.machineImages.create) that seeds code into future instance launches referencing it.
Raw rule rules/derived/gcp/gce.yaml
id: gcp-gce-image-poison
emits: CanModifyCode
description: Create a poisoned image/machine-image that future instances/templates boot from (supply chain).
match_effective_permission:
action: compute.images.create
resource_type: compute.googleapis.com/Image
alt_permission: compute.machineImages.create
where:
- the poisoned image/machine-image is (or will be) referenced by an instance template / MIG / future instance
launch
emit:
source_type: Identity
source: <principal>
target: <image / machine-image (code supply for future launches)>
permissions:
- compute.images.create
- compute.machineImages.create
conditions:
- iam_permission
- trigger_exists
state_logic: CONDITIONAL(trigger_exists) -- realized only when a future instance/template/MIG launch
boots from the poisoned image; creating the image alone is not execution.
false_positive_note: Creating an image is not execution by itself. It becomes CanExecuteAs only when
a template/MIG/new instance references the poisoned image and launches. Lower-frequency but real code-supply
path.
narrative: '{principal.name} can create a poisoned image/machine-image (compute.images.create / compute.machineImages.create)
that seeds code into future instance launches referencing it.'