gcp-gcs-set-iam-self-grant

A principal with CanModifyPolicy on a bucket's IAM policy can grant itself roles/storage.objectViewer or roles/storage.admin and read or administer its objects.

derived gcp emits CanGrantPermission

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?principal`
permissions	`storage.buckets.setIamPolicy`
conditions	`iam_permission`
state logic	ACTIVE if CanModifyPolicy is ACTIVE (setIamPolicy resolves on the bucket); inherits state from CanModifyPolicy input. BLOCKED if an IAM deny or org policy denies it. Chains to CanReadData(principal, bucket) via a self-bound roles/storage.objectViewer, then to ContainsSecret/CanExfiltrate if the bucket holds sensitive data.

source type

Identity

target type

Identity

source

?principal

target

?principal

permissions

storage.buckets.setIamPolicy

conditions

iam_permission

state logic

ACTIVE if CanModifyPolicy is ACTIVE (setIamPolicy resolves on the bucket); inherits state from CanModifyPolicy input. BLOCKED if an IAM deny or org policy denies it. Chains to CanReadData(principal, bucket) via a self-bound roles/storage.objectViewer, then to ContainsSecret/CanExfiltrate if the bucket holds sensitive data.

Narrative

{principal.name} holds CanModifyPolicy on bucket {bucket.name}'s IAM policy and can grant itself roles/storage.objectViewer, then read all objects in the bucket.

Raw rule rules/derived/gcp/gcs.yaml

id: gcp-gcs-set-iam-self-grant
emits: CanGrantPermission
description: A principal with CanModifyPolicy on a bucket's IAM policy can grant itself roles/storage.objectViewer
  or roles/storage.admin and read or administer its objects.
match:
- - principal: null
  - CanModifyPolicy
  - bucket_policy: null
where:
- ?bucket_policy is the ResourcePolicy of ?bucket
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?principal
  permissions:
  - storage.buckets.setIamPolicy
  conditions:
  - iam_permission
  state_logic: ACTIVE if CanModifyPolicy is ACTIVE (setIamPolicy resolves on the bucket); inherits state
    from CanModifyPolicy input. BLOCKED if an IAM deny or org policy denies it. Chains to CanReadData(principal,
    bucket) via a self-bound roles/storage.objectViewer, then to ContainsSecret/CanExfiltrate if the bucket
    holds sensitive data.
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - ?principal CanModifyPolicy ?bucket_policy (produced by gcp-gcs-can-modify-policy)
  false_positive_note: 'Escalation primitive: a principal with CanModifyPolicy can grant itself roles/storage.objectViewer
    (or roles/storage.admin) and read all objects. For CMEK buckets the service-agent KMS gate still applies
    to the subsequent read. Confirm that setIamPolicy is on the SAME bucket the principal intends to read;
    project-scoped grants cover all buckets in the project. Org policy denying iam.setIamPolicy mutations
    -> BLOCKED.'
  narrative: '{principal.name} holds CanModifyPolicy on bucket {bucket.name}''s IAM policy and can grant
    itself roles/storage.objectViewer, then read all objects in the bucket.'