rage.fail

gcp-memorystore-can-read-auth-string

explicit gcp emits CanReadCredential

match (effective permission)

{ "action": "redis.instances.getAuthString", "resource_type": "google.redis.Instance" }

emit

source type	`Identity`
target type	`Credential`
source	`<principal holding redis.instances.getAuthString>`
target	`<AUTH string Credential node for the instance>`
permissions	`redis.instances.getAuthString`

Narrative

{principal.name} holds redis.instances.getAuthString on {instance.name} and can retrieve the Redis AUTH string (UUID) via the Memorystore API. The AUTH string is the shared credential for Redis protocol authentication.

Raw rule rules/explicit/gcp-memorystore.yaml

id: gcp-memorystore-can-read-auth-string
emits: CanReadCredential
applies_to:
- gcp
match_effective_permission:
  action: redis.instances.getAuthString
  resource_type: google.redis.Instance
emit:
  source_type: Identity
  target_type: Credential
  source: <principal holding redis.instances.getAuthString>
  target: <AUTH string Credential node for the instance>
  permissions:
  - redis.instances.getAuthString
  narrative: '{principal.name} holds redis.instances.getAuthString on {instance.name} and can retrieve
    the Redis AUTH string (UUID) via the Memorystore API. The AUTH string is the shared credential for
    Redis protocol authentication.'