gcp-gcs-bucket-update-config
storage.buckets.update allows a principal to modify bucket configuration: UBLA settings, CMEK default key, versioning, Pub/Sub notification configs, retention policy, and logging - enabling encryption ransomware, trigger hijacking, and configuration-based escalation.
match (effective permission)
{
"action": "storage.buckets.update",
"resource_type": "google.storage.Bucket"
}
emit
| source type | Identity |
|---|---|
| target type | ObjectStorage |
| source | <principal> |
| target | <GCS Bucket> |
| permissions | storage.buckets.update |
| conditions | iam_permission resource_policy |
| state logic | ACTIVE when storage.buckets.update is confirmed effective on the bucket and no VPC-SC perimeter or org policy blocks the buckets.update action; CONDITIONAL(resource_policy) when project-level or resource-based restrictions apply; BLOCKED when an IAM deny or org policy denies storage.buckets.update. |
Narrative
{principal.name} holds storage.buckets.update on {bucket.name} and can modify bucket configuration: change UBLA settings, swap CMEK keys, add Pub/Sub notification triggers, adjust retention policy, and toggle logging.
Raw rule rules/derived/gcp/gcs.yaml
id: gcp-gcs-bucket-update-config
emits: CanModifyConfiguration
description: "storage.buckets.update allows a principal to modify bucket configuration: UBLA settings,\
\ CMEK default key, versioning, Pub/Sub notification configs, retention policy, and logging \u2014 enabling\
\ encryption ransomware, trigger hijacking, and configuration-based escalation."
match_effective_permission:
action: storage.buckets.update
resource_type: google.storage.Bucket
emit:
source_type: Identity
target_type: ObjectStorage
source: <principal>
target: <GCS Bucket>
permissions:
- storage.buckets.update
conditions:
- iam_permission
- resource_policy
state_logic: ACTIVE when storage.buckets.update is confirmed effective on the bucket and no VPC-SC perimeter
or org policy blocks the buckets.update action; CONDITIONAL(resource_policy) when project-level or
resource-based restrictions apply; BLOCKED when an IAM deny or org policy denies storage.buckets.update.
confidence: min(contributing_confidences) * 0.95
derived_from:
- storage.buckets.update effective permission on bucket
false_positive_note: 'storage.buckets.update is a powerful configuration verb covering multiple sub-impacts:
(1) UBLA enable/disable changes access control model; (2) defaultKmsKeyName swap to an attacker-controlled
key enables encryption ransomware (new writes encrypt under attacker key, preventing owner decrypt);
(3) notification config add/update enables CanTrigger to downstream functions; (4) lifecycle rules
/ retention policy changes affect data durability and deletion capabilities; (5) logging enable/disable
affects auditability. An attacker with buckets.update can perform any of these mutations, but the
exploitability of each depends on downstream conditions (e.g., KMS key accessibility, notification
config target state). This edge signals configuration-mutation capability; derive specific impacts
(CanTrigger, encryption-blocked) as separate rules when the downstream state is known.'
narrative: '{principal.name} holds storage.buckets.update on {bucket.name} and can modify bucket configuration:
change UBLA settings, swap CMEK keys, add Pub/Sub notification triggers, adjust retention policy,
and toggle logging.'