rage.fail

gcp-gce-set-metadata-ssh-keys

derived gcp emits CanModifyConfiguration

match (effective permission)

{ "action": "compute.instances.setMetadata", "resource_type": "compute.googleapis.com/Instance" }

where

?principal has iam.serviceAccounts.actAs on the instance's current SA OS Login is NOT enforced on the instance/project (enable-oslogin != TRUE)

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<instance>`
permissions	`compute.instances.setMetadata` `iam.serviceAccounts.actAs`
conditions	`iam_permission` `service_state`
state logic	ACTIVE if instance running (ssh-keys login is immediate) else CONDITIONAL(service_state) (takes effect once started)

Narrative

{principal.name} can add an SSH key to {instance.name}'s metadata (compute.instances.setMetadata) and log in immediately.

Raw rule rules/derived/gcp/gce.yaml

id: gcp-gce-set-metadata-ssh-keys
emits: CanModifyConfiguration
match_effective_permission:
  action: compute.instances.setMetadata
  resource_type: compute.googleapis.com/Instance
where:
- ?principal has iam.serviceAccounts.actAs on the instance's current SA
- OS Login is NOT enforced on the instance/project (enable-oslogin != TRUE)
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <instance>
  permissions:
  - compute.instances.setMetadata
  - iam.serviceAccounts.actAs
  conditions:
  - iam_permission
  - service_state
  escalation: Add an ssh-keys entry -> immediate interactive login on a running instance.
  state_logic: ACTIVE if instance running (ssh-keys login is immediate) else CONDITIONAL(service_state)
    (takes effect once started)
  false_positive_note: If OS Login is enforced (enable-oslogin=TRUE) the ssh-keys metadata is ignored
    -> BLOCKED for this path; use gcp-gce-os-login instead. Requires actAs on the current SA. Realized
    OS access still requires tcp/22 reachability (handled in gcp-gce-ssh-metadata).
  narrative: '{principal.name} can add an SSH key to {instance.name}''s metadata (compute.instances.setMetadata)
    and log in immediately.'