gcp-gcs-write-data

id: gcp-gcs-write-data
emits: CanWriteData
description: storage.objects.create constitutes effective data-plane write access to a GCS bucket; also
  enables supply-chain poisoning if the bucket backs a Cloud Function source archive.
match_effective_permission:
  action: storage.objects.create
  resource_type: google.storage.Bucket
emit:
  source_type: Identity
  target_type: Storage
  source: <principal>
  target: <GCS Bucket / ObjectStorage node>
  permissions:
  - storage.objects.create
  conditions:
  - iam_permission
  - resource_policy
  state_logic: ACTIVE when storage.objects.create is confirmed effective on the bucket and no VPC-SC perimeter
    or retention policy (locked / retention lock) prevents object creation; CONDITIONAL(resource_policy)
    when UBLA is disabled and bucket-level conditions may restrict writes; BLOCKED under a VPC-SC perimeter
    deny or org policy.
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - storage.objects.create effective permission on bucket
  false_positive_note: "A locked retention policy on the bucket prevents deletion/overwrite of objects\
    \ within the retention period \u2014 new objects can still be created unless the bucket is also under\
    \ a hold. When the bucket's objects are a Cloud Function source archive, CanWriteData here enables\
    \ CanModifyCode derivation in gcp/gcf.yaml or gcp/cloudrun.yaml \u2014 this file emits the write fact\
    \ and defers the function-escalation derivation to those services. Versioning enabled means old versions\
    \ survive; the write still creates a new version and may redirect function deployments to it."
  narrative: '{principal.name} holds storage.objects.create on bucket {bucket.name} and can write or overwrite
    objects in it (supply-chain risk if bucket backs a Cloud Function source archive).'