gcp-lb-backend-service-update

id: gcp-lb-backend-service-update
emits: CanModifyConfiguration
description: "compute.backendServices.update allows modifying backend service configuration, including\
  \ adding/removing Network Endpoint Groups (NEGs) from the backend pool and changing load-balancing configuration.\
  \ An attacker can add a serverless NEG pointing to an attacker-controlled Cloud Run service to intercept\
  \ a fraction of traffic. NOTE: disabling IAP (iap.enabled=false) is the canonical case covered by gcp-iap-disable-on-backend-service\
  \ in iap.yaml \u2014 this rule focuses on the backend-pool mutation sub-case."
match_effective_permission:
  action: compute.backendServices.update
  resource_type: compute.googleapis.com/BackendService
emit:
  source_type: Identity
  target_type: LoadBalancer
  source: <principal>
  target: <BackendService in scope>
  permissions:
  - compute.backendServices.update
  conditions:
  - iam_permission
  escalation: '(a) Backend swapping: adding a new NEG (including a serverless NEG pointing to an attacker-controlled
    Cloud Run service) to the backend service routes a fraction of traffic to the attacker. Requires compute.networkEndpointGroups.use
    on the NEG. (b) Load balancing scheme change: modifying the balancing mode or capacity scaler can
    affect which backends receive traffic (low impact; included for completeness). (c) IAP disable is
    covered by gcp-iap-disable-on-backend-service in iap.yaml.'
  false_positive_note: "compute.backendServices.update is a broad permission. Impact tiers: (high) Adding\
    \ an attacker-controlled serverless NEG to the backend pool \u2014 attacker\n  receives a fraction\
    \ of sessions (probabilistic, not all); the NEG must already exist\n  and the principal must hold\
    \ compute.networkEndpointGroups.use on it.\n(low) Modifying health check thresholds, timeout, or balancing\
    \ mode \u2014 operational only,\n  not security. For the IAP-disable case and its narrative, see\n\
    \  gcp-iap-disable-on-backend-service in iap.yaml. Regional backend services use\n  compute.regionBackendServices.update;\
    \ confirm scope. Requires confirmation that\n  backendServices.update is not blocked by an IAM deny\
    \ policy or org policy constraint."
  narrative: '{principal.name} can update backend service {target.name} (compute.backendServices.update),
    including adding network endpoint groups to the backend pool. The attacker can create or substitute
    a serverless NEG pointing to an attacker-controlled Cloud Run service to intercept a fraction of traffic.
    For the IAP-disable case, see the companion rule gcp-iap-disable-on-backend-service in iap.yaml.'