rage.fail

gcp-orgpolicy-can-modify-policy

explicit gcp emits CanModifyPolicy

match (effective permission)

{ "action": "orgpolicy.policy.set", "resource_type": "google.cloud.orgpolicy.Policy" }

where

the target OrganizationPolicy is ENFORCED at/inherited-to the scope (a dry-run-only or unset policy is not a guardrail to remove)

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<OrganizationPolicy node at the scope the principal can write>`
permissions	`orgpolicy.policy.set`

Narrative

{principal.name} can set the org policy at {scope.name} (orgpolicy.policy.set) - can weaken/remove the guardrail {orgpolicy.name}.

Raw rule rules/explicit/gcp-orgpolicy.yaml

id: gcp-orgpolicy-can-modify-policy
emits: CanModifyPolicy
applies_to:
- gcp
match_effective_permission:
  action: orgpolicy.policy.set
  resource_type: google.cloud.orgpolicy.Policy
where:
- the target OrganizationPolicy is ENFORCED at/inherited-to the scope (a dry-run-only or unset policy
  is not a guardrail to remove)
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <OrganizationPolicy node at the scope the principal can write>
  api_source: "policy evaluation (IAM Policy Analyzer) \u2014 NOT a live setPolicy call"
  permissions:
  - orgpolicy.policy.set
  evidence_field: effective orgpolicy.policy.set at scope
  narrative: "{principal.name} can set the org policy at {scope.name} (orgpolicy.policy.set) \u2014 can\
    \ weaken/remove the guardrail {orgpolicy.name}."