rage.fail

gcp-memorystore-can-modify-auth-config

explicit gcp emits CanModifyConfiguration

match (effective permission)

{ "action": [ "redis.instances.update", "redis.instances.updateAuth" ], "resource_type": "google.redis.Instance" }

emit

source type	`Identity`
target type	`Cache`
source	`<principal holding redis.instances.update or redis.instances.updateAuth>`
target	`<Memorystore Cache instance node>`
permissions	`redis.instances.update` `redis.instances.updateAuth`

Narrative

{principal.name} can modify configuration on {instance.name}, including the authEnabled flag (redis.instances.update / redis.instances.updateAuth). Disabling AUTH removes the only access control above the VPC network layer, allowing any in-VPC client to connect without credentials.

Raw rule rules/explicit/gcp-memorystore.yaml

id: gcp-memorystore-can-modify-auth-config
emits: CanModifyConfiguration
applies_to:
- gcp
match_effective_permission:
  action:
  - redis.instances.update
  - redis.instances.updateAuth
  resource_type: google.redis.Instance
emit:
  source_type: Identity
  target_type: Cache
  source: <principal holding redis.instances.update or redis.instances.updateAuth>
  target: <Memorystore Cache instance node>
  permissions:
  - redis.instances.update
  - redis.instances.updateAuth
  narrative: '{principal.name} can modify configuration on {instance.name}, including the authEnabled
    flag (redis.instances.update / redis.instances.updateAuth). Disabling AUTH removes the only access
    control above the VPC network layer, allowing any in-VPC client to connect without credentials.'