rage.fail

gcp-gcf-invoke

derived gcp emits CanInvoke

match (effective permission)

{ "action": "cloudfunctions.functions.invoke", "resource_type": "google.cloudfunctions.Function" }

where

?function.environment == GEN_1 (1st-gen function)

emit

source type	`Identity`
source	`<principal>`
target	`<function in scope>`
permissions	`cloudfunctions.functions.invoke` `cloudfunctions.functions.call`
conditions	`service_state` `iam_permission`

Narrative

{principal.name} can invoke 1st-gen {function.name} (cloudfunctions.functions.invoke / .call).

Raw rule rules/derived/gcp/gcf.yaml

id: gcp-gcf-invoke
emits: CanInvoke
match_effective_permission:
  action: cloudfunctions.functions.invoke
  resource_type: google.cloudfunctions.Function
alt_permission: cloudfunctions.functions.call
where:
- ?function.environment == GEN_1 (1st-gen function)
emit:
  source_type: Identity
  source: <principal>
  target: <function in scope>
  permissions:
  - cloudfunctions.functions.invoke
  - cloudfunctions.functions.call
  conditions:
  - service_state
  - iam_permission
  false_positive_note: '1st-gen ONLY. cloudfunctions.functions.invoke/.call is inert on 2nd-gen functions:
    2nd-gen invocation is authorized by run.routes.invoke (roles/run.invoker) on the backing Cloud Run
    service - see gcp-gcf-invoke-run. Do NOT emit an ACTIVE CanInvoke for a 2nd-gen (GEN_2) function from
    this perm.'
  narrative: '{principal.name} can invoke 1st-gen {function.name} (cloudfunctions.functions.invoke / .call).'