rage.fail

gcp-memorystore-can-export-data

explicit gcp emits CanExfiltrate

match (effective permission)

{ "action": "redis.instances.export", "resource_type": "google.redis.Instance" }

emit

source type	`Identity`
target type	`Cache`
source	`<principal holding redis.instances.export>`
target	`<Memorystore Cache instance node>`
permissions	`redis.instances.export`

Narrative

{principal.name} can export the Redis RDB snapshot from {instance.name} (redis.instances.export). An attacker with this permission and write access to a GCS bucket can exfiltrate all in-memory data.

Raw rule rules/explicit/gcp-memorystore.yaml

id: gcp-memorystore-can-export-data
emits: CanExfiltrate
applies_to:
- gcp
match_effective_permission:
  action: redis.instances.export
  resource_type: google.redis.Instance
emit:
  source_type: Identity
  target_type: Cache
  source: <principal holding redis.instances.export>
  target: <Memorystore Cache instance node>
  permissions:
  - redis.instances.export
  narrative: '{principal.name} can export the Redis RDB snapshot from {instance.name} (redis.instances.export).
    An attacker with this permission and write access to a GCS bucket can exfiltrate all in-memory data.'