rage.fail

gcp-gcs-hmac-key-active

explicit gcp emits ExposesCredential

match (record)

{ "api": "storage.hmacKeys.list", "field": "state == \u0027ACTIVE\u0027", "resource_type": "google.storage.HmacKey" }

where

HMAC key state is ACTIVE (the secret was issued and is currently usable)

emit

source type	`Secret`
target type	`Credential`
source	`<HMAC key AccessKey node>`
target	`<service account the HMAC key authenticates (serviceAccountEmail)>`
permissions	`storage.hmacKeys.create (at issuance)`

Narrative

HMAC key {hmacKey.id} for SA {sa.name} is ACTIVE; the holder of the key secret can authenticate to the GCS S3-compatible API as {sa.name}.

Raw rule rules/explicit/gcp-gcs.yaml

id: gcp-gcs-hmac-key-active
emits: ExposesCredential
applies_to:
- gcp
match_record:
  api: storage.hmacKeys.list
  resource_type: google.storage.HmacKey
  field: state == 'ACTIVE'
where:
- HMAC key state is ACTIVE (the secret was issued and is currently usable)
emit:
  source_type: Secret
  target_type: Credential
  source: <HMAC key AccessKey node>
  target: <service account the HMAC key authenticates (serviceAccountEmail)>
  api_source: storage.hmacKeys.list (per project)
  evidence_field: serviceAccountEmail, id (accessId), state == ACTIVE
  permissions:
  - storage.hmacKeys.create (at issuance)
  narrative: HMAC key {hmacKey.id} for SA {sa.name} is ACTIVE; the holder of the key secret can authenticate
    to the GCS S3-compatible API as {sa.name}.