rage.fail

gcp-gce-serial-port-output

derived gcp emits ExposesCredential

match (effective permission)

{ "action": "compute.instances.getSerialPortOutput", "resource_type": "compute.googleapis.com/Instance" }

emit

source	`<instance>`
target	`<credential in serial console output>`
permissions	`compute.instances.getSerialPortOutput`
conditions	`iam_permission`

Narrative

{principal.name} can read {instance.name}'s serial console output (compute.instances.getSerialPortOutput), which may leak boot-time secrets.

Raw rule rules/derived/gcp/gce.yaml

id: gcp-gce-serial-port-output
emits: ExposesCredential
match_effective_permission:
  action: compute.instances.getSerialPortOutput
  resource_type: compute.googleapis.com/Instance
emit:
  source: <instance>
  target: <credential in serial console output>
  permissions:
  - compute.instances.getSerialPortOutput
  conditions:
  - iam_permission
  false_positive_note: Only leaks a credential if secrets are actually printed to the serial console/boot
    log. constraints/compute.disableSerialPortAccess org policy -> BLOCKED. Recon-value even when empty.
  narrative: '{principal.name} can read {instance.name}''s serial console output (compute.instances.getSerialPortOutput),
    which may leak boot-time secrets.'