rage.fail

gcp-gce-os-login

derived gcp emits CanExecuteCommand

match (effective permission)

{ "action": "compute.instances.osAdminLogin", "resource_type": "compute.googleapis.com/Instance" }

where

OS Login is enabled on the instance/project (enable-oslogin=TRUE) ?principal (or attacker host) can reach the instance on tcp/22 ?principal has iam.serviceAccounts.actAs on the instance's SA (serviceAccountUser needed to connect)

emit

source type	`Identity`
source	`<principal>`
target	`<instance>`
permissions	`compute.instances.osAdminLogin` `compute.instances.osLogin` `iam.serviceAccounts.actAs`
conditions	`iam_permission` `service_state` `network_reachability`
state logic	ACTIVE if OS Login enabled AND tcp/22 reachable AND actAs held else CONDITIONAL

Narrative

{principal.name} can log into {instance.name} via OS Login (compute.instances.osAdminLogin), gaining sudo command execution.

Raw rule rules/derived/gcp/gce.yaml

id: gcp-gce-os-login
emits: CanExecuteCommand
match_effective_permission:
  action: compute.instances.osAdminLogin
  resource_type: compute.googleapis.com/Instance
alt_permission: compute.instances.osLogin
where:
- OS Login is enabled on the instance/project (enable-oslogin=TRUE)
- ?principal (or attacker host) can reach the instance on tcp/22
- ?principal has iam.serviceAccounts.actAs on the instance's SA (serviceAccountUser needed to connect)
emit:
  source_type: Identity
  source: <principal>
  target: <instance>
  permissions:
  - compute.instances.osAdminLogin
  - compute.instances.osLogin
  - iam.serviceAccounts.actAs
  conditions:
  - iam_permission
  - service_state
  - network_reachability
  state_logic: ACTIVE if OS Login enabled AND tcp/22 reachable AND actAs held else CONDITIONAL
  false_positive_note: osAdminLogin/osLogin only apply when OS Login is enabled; otherwise BLOCKED (use
    ssh-keys metadata). Connecting also requires serviceAccountUser (actAs) on the instance SA.
  narrative: '{principal.name} can log into {instance.name} via OS Login (compute.instances.osAdminLogin),
    gaining sudo command execution.'