rage.fail

gcp-gce-image-share

derived gcp emits CanExfiltrate

match (effective permission)

{ "action": "compute.images.setIamPolicy", "resource_type": "compute.googleapis.com/Image" }

emit

source	`<principal>`
target	`<image/machine-image data>`
permissions	`compute.images.setIamPolicy` `compute.machineImages.setIamPolicy`
conditions	`iam_permission`

Narrative

{principal.name} can grant an external principal use of image {image.name} (compute.images.setIamPolicy), enabling cross-project disk data reuse.

Raw rule rules/derived/gcp/gce.yaml

id: gcp-gce-image-share
emits: CanExfiltrate
match_effective_permission:
  action: compute.images.setIamPolicy
  resource_type: compute.googleapis.com/Image
alt_permission: compute.machineImages.setIamPolicy
emit:
  source: <principal>
  target: <image/machine-image data>
  permissions:
  - compute.images.setIamPolicy
  - compute.machineImages.setIamPolicy
  conditions:
  - iam_permission
  false_positive_note: Only cross-boundary when the grant names a principal in another project/org; granting
    within the same project is not exfiltration.
  narrative: '{principal.name} can grant an external principal use of image {image.name} (compute.images.setIamPolicy),
    enabling cross-project disk data reuse.'