rage.fail

gcp-gce-start-triggers-startup-script

derived gcp emits CanStart

match (effective permission)

{ "action": "compute.instances.start", "resource_type": "compute.googleapis.com/Instance" }

emit

source type	`Identity`
target type	`Compute`
source	`<principal>`
target	`<instance>`
permissions	`compute.instances.start` `compute.instances.reset`

Narrative

{principal.name} can start/reset {instance.name} (compute.instances.start/reset), triggering a poisoned startup-script.

Raw rule rules/derived/gcp/gce.yaml

id: gcp-gce-start-triggers-startup-script
emits: CanStart
match_effective_permission:
  action: compute.instances.start
  resource_type: compute.googleapis.com/Instance
alt_permission: compute.instances.reset
emit:
  source_type: Identity
  target_type: Compute
  source: <principal>
  target: <instance>
  permissions:
  - compute.instances.start
  - compute.instances.reset
  note: Realizes CONDITIONAL(service_state) startup-script code paths (see gcp-gce-set-metadata-startup-script).
  narrative: '{principal.name} can start/reset {instance.name} (compute.instances.start/reset), triggering
    a poisoned startup-script.'