rage.fail

gcp-gcf-exposes-runtime-sa

Code running in the function reads the runtime SA token from the metadata server.

derived gcp emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteAs {'sa': None}

emit

source	`<function>`
target	`<runtime service account>`

Narrative

{function.name} exposes credentials for {sa.name} to any code it runs (GCE metadata server token endpoint).

Raw rule rules/derived/gcp/gcf.yaml

id: gcp-gcf-exposes-runtime-sa
emits: ExposesCredential
description: Code running in the function reads the runtime SA token from the metadata server.
match:
- - principal: null
  - CanExecuteAs
  - sa: null
emit:
  source: <function>
  target: <runtime service account>
  permissions: []
  note: 'Metadata endpoint: http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token'
  narrative: '{function.name} exposes credentials for {sa.name} to any code it runs (GCE metadata server
    token endpoint).'