gcp-monitoring-disable-alert-policy

id: gcp-monitoring-disable-alert-policy
emits: CanModifyConfiguration
description: "Principal can disable or delete Cloud Monitoring alert policies (monitoring.alertPolicies.update\
  \ / monitoring.alertPolicies.delete), preventing alerting rules from firing on anomalies \u2014 a defense-evasion\
  \ primitive that does not grant access to any resource."
match:
- - principal: null
  - HasPermission
  - monitoring: null
where:
- node_type(?monitoring) == LoggingService
- node_class(?monitoring) == ManagementService
- ?monitoring.provider_type == 'google.monitoring.Workspace'
- ?principal has EFFECTIVE monitoring.alertPolicies.update OR monitoring.alertPolicies.delete on ?monitoring
  (project scope)
emit:
  source_type: Identity
  target_type: LoggingService
  source: ?principal
  target: ?monitoring
  permissions:
  - monitoring.alertPolicies.update
  - monitoring.alertPolicies.delete
  conditions:
  - iam_permission
  - api_enabled
  state_logic: ACTIVE if monitoring.alertPolicies.update or monitoring.alertPolicies.delete is in the
    principal's effective IAM grants for the project scope and the Cloud Monitoring API is enabled; BLOCKED
    if an IAM deny policy or org policy denies both actions; CONDITIONAL(api_enabled) if Cloud Monitoring
    API enablement is unknown.
  confidence: 0.9
  derived_from:
  - ?principal HasPermission ?monitoring (monitoring.alertPolicies.update or monitoring.alertPolicies.delete
    effective)
  false_positive_note: "Alert policies are a DETECTIVE control \u2014 disabling them reduces detection\
    \ fidelity but does not block any access path in the graph. Do NOT chain to CanExecuteAs, CanEscalateTo,\
    \ or CanEnterProject. monitoring.alertPolicies.update can set `enabled: false` (a stealthy disable)\
    \ or weaken conditions without deletion; monitoring.alertPolicies.delete permanently removes the policy.\
    \ Both are captured by this single rule because the attacker impact (silencing the alert) is the same\
    \ regardless of method. The monitoring.snoozes.create permission (temporary silence for a time window)\
    \ is a weaker variant subsumed by this rule's narrative; emit this edge when snoozes.create is the\
    \ only confirmed permission but note the lower persistence in the evidence record. roles/monitoring.viewer\
    \ and roles/monitoring.metricWriter do NOT grant either action \u2014 verify effective grants before\
    \ emitting. Cloud Monitoring IAM bindings are project-scoped; there are no resource-level policies\
    \ on individual alert policies, so any project-level binding applies to all alert policies in the\
    \ project."
  narrative: '{principal.name} can disable or delete Cloud Monitoring alert policies in project {monitoring.project}
    (monitoring.alertPolicies.update / monitoring.alertPolicies.delete). Setting an alert policy to `enabled:
    false` or deleting it prevents Cloud Monitoring from generating incidents for the conditions that
    policy covered (e.g. anomalous metric spikes, login failures, quota exhaustion), silencing detection
    for attacker activity without granting any resource access. This is a defense-evasion / cover-tracks
    action.'