rage.fail

gcp-gce-ssh-metadata

SSH-key metadata (instance or project) yields interactive command exec.

derived gcp emits CanExecuteCommand

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanModifyConfiguration {'instance': None}

where

the CanModifyConfiguration derivation was the ssh-keys metadata path (gcp-gce-set-metadata-ssh-keys or -set-common-instance-metadata) ?principal (or attacker host) can reach the instance on tcp/22

emit

source type	`Identity`
source	`<principal>`
target	`<instance>`
permissions	`compute.instances.setMetadata OR compute.projects.setCommonInstanceMetadata`
conditions	`network_reachability`
state logic	ACTIVE if tcp/22 reachable else CONDITIONAL(network_reachability)

Narrative

{principal.name} can run OS commands on {instance.name} via an injected SSH key over tcp/22.

Raw rule rules/derived/gcp/gce.yaml

id: gcp-gce-ssh-metadata
emits: CanExecuteCommand
description: SSH-key metadata (instance or project) yields interactive command exec.
match:
- - principal: null
  - CanModifyConfiguration
  - instance: null
where:
- the CanModifyConfiguration derivation was the ssh-keys metadata path (gcp-gce-set-metadata-ssh-keys
  or -set-common-instance-metadata)
- ?principal (or attacker host) can reach the instance on tcp/22
emit:
  source_type: Identity
  source: <principal>
  target: <instance>
  permissions:
  - compute.instances.setMetadata OR compute.projects.setCommonInstanceMetadata
  conditions:
  - network_reachability
  state_logic: ACTIVE if tcp/22 reachable else CONDITIONAL(network_reachability)
  narrative: '{principal.name} can run OS commands on {instance.name} via an injected SSH key over tcp/22.'