rage.fail

gcp-gcf-cross-project-code

A principal in project A controls code/config of a function in project B whose runtime SA has power in B.

derived gcp emits CanEnterProject

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteAs {'sa': None}

where

?function.project != ?principal.project ?sa has bindings granting privilege in ?function.project

emit

source type	`Identity`
target type	`Project`
source	`<principal>`
target	`<function.project>`
permissions	`cloudfunctions.functions.sourceCodeSet \| .update \| .create` `iam.serviceAccounts.actAs?`

Narrative

{principal.name} can run code as {sa.name} in project {project.name} via {function.name}, entering that project.

Raw rule rules/derived/gcp/gcf.yaml

id: gcp-gcf-cross-project-code
emits: CanEnterProject
description: A principal in project A controls code/config of a function in project B whose runtime SA
  has power in B.
match:
- - principal: null
  - CanExecuteAs
  - sa: null
where:
- ?function.project != ?principal.project
- ?sa has bindings granting privilege in ?function.project
emit:
  source_type: Identity
  target_type: Project
  source: <principal>
  target: <function.project>
  permissions:
  - cloudfunctions.functions.sourceCodeSet | .update | .create
  - iam.serviceAccounts.actAs?
  false_positive_note: Only cross-boundary when principal and function live in different projects AND
    the runtime SA is privileged in the function's project.
  narrative: '{principal.name} can run code as {sa.name} in project {project.name} via {function.name},
    entering that project.'