gcp-gce-snapshot-cross-project
Snapshot a disk and reuse it from another project.
match (effective permission)
{
"action": "compute.snapshots.create",
"resource_type": "compute.googleapis.com/Disk"
}
where
?principal (or a cross-project principal it controls) has compute.snapshots.useReadOnly / compute.disks.create from the snapshot
emit
| source | <principal> |
|---|---|
| target | <disk data via snapshot> |
| permissions | compute.snapshots.create compute.disks.create compute.snapshots.useReadOnly |
| conditions | iam_permission |
Narrative
{principal.name} can snapshot {disk.name} and create a disk from it in another project, exfiltrating its contents.
Raw rule rules/derived/gcp/gce.yaml
id: gcp-gce-snapshot-cross-project
emits: CanExfiltrate
description: Snapshot a disk and reuse it from another project.
match_effective_permission:
action: compute.snapshots.create
resource_type: compute.googleapis.com/Disk
where:
- ?principal (or a cross-project principal it controls) has compute.snapshots.useReadOnly / compute.disks.create
from the snapshot
emit:
source: <principal>
target: <disk data via snapshot>
permissions:
- compute.snapshots.create
- compute.disks.create
- compute.snapshots.useReadOnly
conditions:
- iam_permission
false_positive_note: Cross-boundary only if the snapshot/image is actually shared (setIamPolicy) to
a principal outside the source project; same-project snapshotting is not exfiltration.
narrative: '{principal.name} can snapshot {disk.name} and create a disk from it in another project,
exfiltrating its contents.'