rage.fail

gcp-gcf-create-workload-as

Create a new function bound to a passable SA (create + actAs).

derived gcp emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'sa': None}

where

?principal has cloudfunctions.functions.create in scope ?principal has iam.serviceAccounts.actAs on ?sa

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<service account>`
permissions	`cloudfunctions.functions.create` `iam.serviceAccounts.actAs`

Narrative

{principal.name} can create a function bound to {sa.name} (cloudfunctions.functions.create + iam.serviceAccounts.actAs), executing code as {sa.name}.

Raw rule rules/derived/gcp/gcf.yaml

id: gcp-gcf-create-workload-as
emits: CanCreateWorkloadAs
description: Create a new function bound to a passable SA (create + actAs).
match:
- - principal: null
  - CanPassIdentity
  - sa: null
where:
- ?principal has cloudfunctions.functions.create in scope
- ?principal has iam.serviceAccounts.actAs on ?sa
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <service account>
  permissions:
  - cloudfunctions.functions.create
  - iam.serviceAccounts.actAs
  escalation: Deploy a new function whose runtime SA is a privileged SA, then invoke it.
  false_positive_note: actAs must apply to the chosen SA. Without it -> POTENTIAL. New function is attacker-invocable
    (attacker sets the invoker binding or has invoke).
  narrative: '{principal.name} can create a function bound to {sa.name} (cloudfunctions.functions.create
    + iam.serviceAccounts.actAs), executing code as {sa.name}.'