rage.fail

gcp-gce-set-metadata-startup-script

derived gcp emits CanModifyCode

match (effective permission)

{ "action": "compute.instances.setMetadata", "resource_type": "compute.googleapis.com/Instance" }

where

?principal has iam.serviceAccounts.actAs on the instance's current SA (GCE refuses setMetadata otherwise)

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

?principal has compute.instances.reset OR (compute.instances.stop AND compute.instances.start)

emit

source type	`Identity`
source	`<principal>`
target	`<instance>`
permissions	`compute.instances.setMetadata` `iam.serviceAccounts.actAs` `compute.instances.reset?`
conditions	`iam_permission` `service_state`
state logic	ACTIVE if reset/stop+start also held (script runs now) else CONDITIONAL(service_state) (fires at next boot)

Narrative

{principal.name} can write a startup-script to {instance.name}'s metadata (compute.instances.setMetadata); on next boot/reset it runs as root as {sa.name}.

Raw rule rules/derived/gcp/gce.yaml

id: gcp-gce-set-metadata-startup-script
emits: CanModifyCode
match_effective_permission:
  action: compute.instances.setMetadata
  resource_type: compute.googleapis.com/Instance
where:
- ?principal has iam.serviceAccounts.actAs on the instance's current SA (GCE refuses setMetadata otherwise)
optional:
- ?principal has compute.instances.reset OR (compute.instances.stop AND compute.instances.start)
emit:
  source_type: Identity
  source: <principal>
  target: <instance>
  permissions:
  - compute.instances.setMetadata
  - iam.serviceAccounts.actAs
  - compute.instances.reset?
  conditions:
  - iam_permission
  - service_state
  state_logic: ACTIVE if reset/stop+start also held (script runs now) else CONDITIONAL(service_state)
    (fires at next boot)
  false_positive_note: startup-script executes at boot only. setMetadata is refused without actAs on the
    instance's current SA -> POTENTIAL. If OS Login is enforced it does not affect startup-script (that
    path still works).
  narrative: '{principal.name} can write a startup-script to {instance.name}''s metadata (compute.instances.setMetadata);
    on next boot/reset it runs as root as {sa.name}.'