rage.fail

gcp-orgpolicy-can-modify-custom-constraint

explicit gcp emits CanModifyPolicy

match (effective permission)

{ "any_of": [ { "action": "orgpolicy.customConstraints.delete", "resource_type": "google.cloud.orgpolicy.CustomConstraint" }, { "action": "orgpolicy.customConstraints.update", "resource_type": "google.cloud.orgpolicy.CustomConstraint" } ] }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<custom OrganizationPolicy node>`
permissions	`orgpolicy.customConstraints.delete` `orgpolicy.customConstraints.update`

Narrative

{principal.name} can delete/alter custom org-policy constraint {orgpolicy.name} (orgpolicy.customConstraints.delete/update).

Raw rule rules/explicit/gcp-orgpolicy.yaml

id: gcp-orgpolicy-can-modify-custom-constraint
emits: CanModifyPolicy
applies_to:
- gcp
match_effective_permission:
  any_of:
  - action: orgpolicy.customConstraints.delete
    resource_type: google.cloud.orgpolicy.CustomConstraint
  - action: orgpolicy.customConstraints.update
    resource_type: google.cloud.orgpolicy.CustomConstraint
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <custom OrganizationPolicy node>
  api_source: "policy evaluation \u2014 NOT a live delete/update call"
  permissions:
  - orgpolicy.customConstraints.delete
  - orgpolicy.customConstraints.update
  narrative: '{principal.name} can delete/alter custom org-policy constraint {orgpolicy.name} (orgpolicy.customConstraints.delete/update).'