rage.fail

gcp-gcs-can-modify-policy

explicit gcp emits CanModifyPolicy

match (effective permission)

{ "action": "storage.buckets.setIamPolicy", "resource_type": "google.storage.Bucket" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<bucket ResourcePolicy node>`
permissions	`storage.buckets.setIamPolicy`

Narrative

{principal.name} can overwrite the IAM policy of {bucket.name} (storage.buckets.setIamPolicy).

Raw rule rules/explicit/gcp-gcs.yaml

id: gcp-gcs-can-modify-policy
emits: CanModifyPolicy
applies_to:
- gcp
match_effective_permission:
  action: storage.buckets.setIamPolicy
  resource_type: google.storage.Bucket
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <bucket ResourcePolicy node>
  api_source: Cloud Asset Inventory analyzeIamPolicy
  evidence_field: storage.buckets.setIamPolicy effective permission
  permissions:
  - storage.buckets.setIamPolicy
  narrative: '{principal.name} can overwrite the IAM policy of {bucket.name} (storage.buckets.setIamPolicy).'