gcp-ncc-hub-update-disable-acceptance

id: gcp-ncc-hub-update-disable-acceptance
emits: CanModifyConfiguration
description: A principal with effective networkconnectivity.hubs.update on a hub can disable the spoke
  acceptance gate by setting requireAcceptance=false. This eliminates the approval gate, auto-accepting
  all PENDING_REVIEW spokes (including attacker-controlled ones) immediately and placing them on the routing
  fabric without manual review.
applies_to:
- gcp
match_effective_permission:
  action: networkconnectivity.hubs.update
  resource_type: networkconnectivity.googleapis.com/Hub
where:
- hub.requireAcceptance == true (currently enforced; principal can flip to false)
emit:
  source_type: Identity
  target_type: TransitGateway
  source: <principal>
  target: <NCC Hub (TransitGateway) node>
  permissions:
  - networkconnectivity.hubs.update
  conditions:
  - iam_permission
  - service_state
  state_logic: ACTIVE if ?principal holds networkconnectivity.hubs.update (effective). CONDITIONAL(iam_permission)
    if the effective-permission evaluator cannot confirm the permission.
  confidence: '0.95'
  derived_from:
  - '<effective permission: networkconnectivity.hubs.update on hub project>'
  false_positive_note: (1) This rule applies when a hub has requireAcceptance=true. If requireAcceptance=false,
    the gate is already disabled. (2) networkconnectivity.hubs.update grants full control of hub configuration,
    including routingVpcs and requireAcceptance. (3) An IAM Deny policy blocking networkconnectivity.hubs.update
    or VPC Service Controls blocking the API should downgrade to BLOCKED.
  narrative: "{principal.name} holds networkconnectivity.hubs.update on NCC Hub {hub.name} and can disable\
    \ spoke acceptance by setting requireAcceptance=false. This immediately auto-accepts all PENDING_REVIEW\
    \ spokes, placing any pending attacker-controlled spoke on the hub's routing fabric without manual\
    \ review \u2014 a direct bypass of the spoke approval gate."