rage.fail

gcp-gce-set-common-instance-metadata

derived gcp emits CanModifyConfiguration

match (effective permission)

{ "action": "compute.projects.setCommonInstanceMetadata", "resource_type": "compute.googleapis.com/Project" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<project (all non-opted-out instances)>`
permissions	`compute.projects.setCommonInstanceMetadata`
conditions	`iam_permission`

Narrative

{principal.name} can set project-wide SSH keys/startup metadata (compute.projects.setCommonInstanceMetadata), reaching all non-opted-out instances in the project.

Raw rule rules/derived/gcp/gce.yaml

id: gcp-gce-set-common-instance-metadata
emits: CanModifyConfiguration
match_effective_permission:
  action: compute.projects.setCommonInstanceMetadata
  resource_type: compute.googleapis.com/Project
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <project (all non-opted-out instances)>
  permissions:
  - compute.projects.setCommonInstanceMetadata
  conditions:
  - iam_permission
  escalation: Set project-wide ssh-keys / startup-script -> access to every instance that does not block
    project SSH keys.
  false_positive_note: Instances with block-project-ssh-keys=TRUE or enforced OS Login ignore project
    SSH keys; those targets are BLOCKED for this path. Broad blast radius otherwise.
  narrative: '{principal.name} can set project-wide SSH keys/startup metadata (compute.projects.setCommonInstanceMetadata),
    reaching all non-opted-out instances in the project.'