gcp-gcf-execute-as-via-config-injection
Config change (env/secret/entry point) that injects code + run + ExecutesAs.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
{'principal': None}
CanModifyConfiguration {'function': None}
{'function': None} ExecutesAs {'sa': None}
where
node_type(?function) ==
ServerlessFunction
?sa.privilege_level >= ?principal.privilege_level
optional
Present → upgrade the emitted state; absent → downgrade (not a hard requirement).
{'principal': None}
CanInvoke {'function': None}
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <runtime service account> |
| permissions | cloudfunctions.functions.update |
| state logic | ACTIVE if matched(optional[0]) or trigger_exists(?function) else CONDITIONAL(trigger_exists) |
Narrative
{principal.name} can inject code into {function.name} via config (cloudfunctions.functions.update) and run it, executing as {sa.name}.
Raw rule rules/derived/gcp/gcf.yaml
id: gcp-gcf-execute-as-via-config-injection
emits: CanExecuteAs
description: Config change (env/secret/entry point) that injects code + run + ExecutesAs.
match:
- - principal: null
- CanModifyConfiguration
- function: null
- - function: null
- ExecutesAs
- sa: null
optional:
- - principal: null
- CanInvoke
- function: null
where:
- node_type(?function) == ServerlessFunction
- ?sa.privilege_level >= ?principal.privilege_level
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <runtime service account>
permissions:
- cloudfunctions.functions.update
state_logic: ACTIVE if matched(optional[0]) or trigger_exists(?function) else CONDITIONAL(trigger_exists)
conditions_from:
- function: null
- sa: null
false_positive_note: Same trigger gating as the code path. update carries source too, so this overlaps
gcp-gcf-execute-as-via-code.
narrative: '{principal.name} can inject code into {function.name} via config (cloudfunctions.functions.update)
and run it, executing as {sa.name}.'