gcp-lb-admin
Holding compute.loadBalancerAdmin-equivalent permissions (roles/compute.loadBalancerAdmin or roles/compute.networkAdmin / roles/compute.admin) grants full create/update/delete control over all Cloud Load Balancing resources: forwarding rules, target proxies, URL maps, backend services, NEGs, health checks, SSL certificates.
match (effective permission)
{
"action": "compute.globalForwardingRules.create",
"resource_type": "compute.googleapis.com/GlobalForwardingRule"
}
where
principal effectively holds compute.globalForwardingRules.* AND compute.urlMaps.* AND compute.backendServices.* (i.e. roles/compute.loadBalancerAdmin or superset — not merely compute.*.get/list)
emit
| source type | Identity |
|---|---|
| target type | LoadBalancer |
| source | <principal> |
| target | <Cloud Load Balancing resources in scope> |
| permissions | compute.globalForwardingRules.create compute.globalForwardingRules.delete compute.urlMaps.update compute.backendServices.update compute.networkEndpointGroups.create compute.targetHttpsProxies.create compute.sslCertificates.create |
| conditions | iam_permission |
Narrative
{principal.name} holds roles/compute.loadBalancerAdmin or equivalent and can fully control all Cloud Load Balancing resources in scope, including adding public frontend IPs, rewriting URL maps, and disabling IAP on backend services via compute.backendServices.update. IAP resource-policy mutation requires separate compute.backendServices.setIamPolicy permission.
Raw rule rules/derived/gcp/loadbalancing.yaml
id: gcp-lb-admin
emits: CanAdminister
description: 'Holding compute.loadBalancerAdmin-equivalent permissions (roles/compute.loadBalancerAdmin
or roles/compute.networkAdmin / roles/compute.admin) grants full create/update/delete control over all
Cloud Load Balancing resources: forwarding rules, target proxies, URL maps, backend services, NEGs,
health checks, SSL certificates.'
match_effective_permission:
action: compute.globalForwardingRules.create
resource_type: compute.googleapis.com/GlobalForwardingRule
where:
- "principal effectively holds compute.globalForwardingRules.* AND compute.urlMaps.* AND compute.backendServices.*\
\ (i.e. roles/compute.loadBalancerAdmin or superset \u2014 not merely compute.*.get/list)"
emit:
source_type: Identity
target_type: LoadBalancer
source: <principal>
target: <Cloud Load Balancing resources in scope>
permissions:
- compute.globalForwardingRules.create
- compute.globalForwardingRules.delete
- compute.urlMaps.update
- compute.backendServices.update
- compute.networkEndpointGroups.create
- compute.targetHttpsProxies.create
- compute.sslCertificates.create
conditions:
- iam_permission
false_positive_note: CanAdminister requires the full write wildcard (roles/compute.loadBalancerAdmin
or equivalent). A principal with only compute.*.get / compute.*.list (roles/compute.viewer) does NOT
qualify. roles/compute.loadBalancerAdmin does NOT include compute.backendServices.setIamPolicy; IAP
policy changes require separate permissions (roles/compute.securityAdmin, roles/compute.admin, or
a custom role containing that specific permission). Verify the full effective permission set is present
and not blocked by an IAM deny policy. roles/compute.loadBalancerAdmin does NOT include compute.instances.*
or iam.serviceAccounts.actAs; escalation to backend SA requires additional permissions (handled in
gce.yaml / cloudrun.yaml via backend execution paths).
narrative: '{principal.name} holds roles/compute.loadBalancerAdmin or equivalent and can fully control
all Cloud Load Balancing resources in scope, including adding public frontend IPs, rewriting URL maps,
and disabling IAP on backend services via compute.backendServices.update. IAP resource-policy mutation
requires separate compute.backendServices.setIamPolicy permission.'