gcp-iap-tunnel-dest-group-access

A principal with iap.tunnelDestGroups.accessViaIAP can reach hosts in a TunnelDestGroup via IAP TCP forwarding. DestGroups enable IAP tunnels to non-GCE endpoints (Cloud Run internal, on-prem hosts, or other private services reachable within the VPC). This provides private-network reach to those endpoints without a VPN.

derived gcp emits CanNetworkReach

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`PrivateEndpoint`
source	`?principal`
target	`?destgroup`
permissions	`iap.tunnelDestGroups.accessViaIAP`
conditions	`iam_permission` `network_reachability`
state logic	if effective_permission(?principal, ?destgroup) contains 'iap.tunnelDestGroups.accessViaIAP' AND network_path_exists_within_vpc(?destgroup): ACTIVE else: CONDITIONAL(network_reachability)

source type

Identity

target type

PrivateEndpoint

source

?principal

target

?destgroup

permissions

iap.tunnelDestGroups.accessViaIAP

conditions

iam_permission network_reachability

state logic

if effective_permission(?principal, ?destgroup) contains 'iap.tunnelDestGroups.accessViaIAP' AND network_path_exists_within_vpc(?destgroup): ACTIVE else: CONDITIONAL(network_reachability)

Narrative

{principal.name} holds iap.tunnelDestGroups.accessViaIAP on destination group {destgroup.name} and can reach the hosts/CIDRs in that group via IAP TCP forwarding - providing private-network access to those endpoints from any location with HTTPS connectivity to Google.

Raw rule rules/derived/gcp/iap.yaml

id: gcp-iap-tunnel-dest-group-access
emits: CanNetworkReach
description: A principal with iap.tunnelDestGroups.accessViaIAP can reach hosts in a TunnelDestGroup via
  IAP TCP forwarding. DestGroups enable IAP tunnels to non-GCE endpoints (Cloud Run internal, on-prem
  hosts, or other private services reachable within the VPC). This provides private-network reach to those
  endpoints without a VPN.
match:
- - principal: null
  - HasPermission
  - destgroup: null
where:
- node_type(?destgroup) == PrivateEndpoint
- ?destgroup.provider_type == 'iap.googleapis.com/TunnelDestGroup'
- effective_permission(?principal, ?destgroup) contains 'iap.tunnelDestGroups.accessViaIAP'
emit:
  source_type: Identity
  target_type: PrivateEndpoint
  source: ?principal
  target: ?destgroup
  permissions:
  - iap.tunnelDestGroups.accessViaIAP
  conditions:
  - iam_permission
  - network_reachability
  state_logic: "if effective_permission(?principal, ?destgroup) contains 'iap.tunnelDestGroups.accessViaIAP'\
    \ AND network_path_exists_within_vpc(?destgroup):\n  ACTIVE\nelse:\n  CONDITIONAL(network_reachability)"
  confidence: 0.8
  derived_from:
  - HasPermission(?principal, ?destgroup) [iap.tunnelDestGroups.accessViaIAP]
  false_positive_note: "TunnelDestGroups can include CIDR ranges or FQDNs reachable from the VPC. Reachability\
    \ to the actual target host within the destgroup depends on the VPC-internal routing and firewall\
    \ rules for those ranges \u2014 those are the network-chains linchpin (future work). This rule emits\
    \ the IAP-authorized reach to the destgroup endpoint, not transitive reach inside the group's CIDR\
    \ range. Downgrade to CONDITIONAL(network_reachability) when VPC routing to group members is not confirmed."
  narrative: "{principal.name} holds iap.tunnelDestGroups.accessViaIAP on destination group {destgroup.name}\
    \ and can reach the hosts/CIDRs in that group via IAP TCP forwarding \u2014 providing private-network\
    \ access to those endpoints from any location with HTTPS connectivity to Google."