rage.fail

gcp-kms-can-modify-policy

explicit gcp emits CanModifyPolicy

match (effective permission)

{ "any_of": [ { "action": "cloudkms.cryptoKeys.setIamPolicy", "resource_type": "google.cloud.kms.CryptoKey" }, { "action": "cloudkms.keyRings.setIamPolicy", "resource_type": "google.cloud.kms.KeyRing" } ] }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<CryptoKey (or KeyRing) allow policy node>`
permissions	`cloudkms.cryptoKeys.setIamPolicy` `cloudkms.keyRings.setIamPolicy`

Narrative

{principal.name} can modify the IAM allow policy of {key.name} (cloudkms.cryptoKeys.setIamPolicy, or cloudkms.keyRings.setIamPolicy on its ring - inherited by every key) - self-grant decrypt/sign.

Raw rule rules/explicit/gcp-kms.yaml

id: gcp-kms-can-modify-policy
emits: CanModifyPolicy
applies_to:
- gcp
match_effective_permission:
  any_of:
  - action: cloudkms.cryptoKeys.setIamPolicy
    resource_type: google.cloud.kms.CryptoKey
  - action: cloudkms.keyRings.setIamPolicy
    resource_type: google.cloud.kms.KeyRing
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <CryptoKey (or KeyRing) allow policy node>
  permissions:
  - cloudkms.cryptoKeys.setIamPolicy
  - cloudkms.keyRings.setIamPolicy
  narrative: "{principal.name} can modify the IAM allow policy of {key.name} (cloudkms.cryptoKeys.setIamPolicy,\
    \ or cloudkms.keyRings.setIamPolicy on its ring \u2014 inherited by every key) \u2014 self-grant decrypt/sign."