gcp-orgpolicy-modify-default-sa-grants-guardrail

Remove iam.automaticIamGrantsForDefaultServiceAccounts to re-enable over-privileged default SAs on new resources.

derived gcp emits CanModifyPolicy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`*`
source	`?principal`
target	`?orgpolicy`
permissions	`orgpolicy.policy.set`
conditions	`guardrail_enforced` `future_scoped`
state logic	POTENTIAL by default: removing this hardening constraint does NOT retroactively over-privilege EXISTING default SAs; it only re-enables the automatic Editor grant on resources/projects created AFTER removal. Emit the CanModifyPolicy but mark the downstream effect POTENTIAL(future_scoped) — it materializes only when a new default SA is subsequently created.

source type

Identity

target type

*

source

?principal

target

?orgpolicy

permissions

orgpolicy.policy.set

conditions

guardrail_enforced future_scoped

state logic

POTENTIAL by default: removing this hardening constraint does NOT retroactively over-privilege EXISTING default SAs; it only re-enables the automatic Editor grant on resources/projects created AFTER removal. Emit the CanModifyPolicy but mark the downstream effect POTENTIAL(future_scoped) — it materializes only when a new default SA is subsequently created.

Narrative

{principal.name} can remove constraints/iam.automaticIamGrantsForDefaultServiceAccounts at {scope.name}, re-enabling the over-privileged automatic Editor grant to default service accounts on resources created afterwards in {scope.name}.

Raw rule rules/derived/gcp/orgpolicy.yaml

id: gcp-orgpolicy-modify-default-sa-grants-guardrail
emits: CanModifyPolicy
description: Remove iam.automaticIamGrantsForDefaultServiceAccounts to re-enable over-privileged default
  SAs on new resources.
match:
- - principal: null
  - CanModifyPolicy
  - orgpolicy: null
where:
- node_type(?orgpolicy) == OrganizationPolicy
- ?orgpolicy.constraint == 'constraints/iam.automaticIamGrantsForDefaultServiceAccounts'
- "?orgpolicy is ENFORCED at/inherited-to ?scope (boolean enforce==true \u2014 hardening constraint)"
- ?principal has EFFECTIVE orgpolicy.policy.set at ?scope
optional: []
emit:
  source_type: Identity
  target_type: '*'
  source: ?principal
  target: ?orgpolicy
  permissions:
  - orgpolicy.policy.set
  gates:
  - "automatic Editor grant to default service accounts (compute/appengine default SA) on NEWLY created\
    \ resources \u2014 future-scoped"
  conditions:
  - guardrail_enforced
  - future_scoped
  state_logic: "POTENTIAL by default: removing this hardening constraint does NOT retroactively over-privilege\
    \ EXISTING default SAs; it only re-enables the automatic Editor grant on resources/projects created\
    \ AFTER removal. Emit the CanModifyPolicy but mark the downstream effect POTENTIAL(future_scoped)\
    \ \u2014 it materializes only when a new default SA is subsequently created."
  confidence: min(contributing_confidences) * 0.7
  derived_from:
  - ?principal CanModifyPolicy ?orgpolicy
  - guardrail-removal-upgrades-blocked (hierarchy-chains.yaml)
  false_positive_note: "Lower value and future-scoped. Do NOT claim this immediately escalates \u2014\
    \ existing bindings are unaffected. Only meaningful in an environment where the attacker can also\
    \ cause new default-SA-bearing resources to be created. Keep POTENTIAL."
  narrative: '{principal.name} can remove constraints/iam.automaticIamGrantsForDefaultServiceAccounts
    at {scope.name}, re-enabling the over-privileged automatic Editor grant to default service accounts
    on resources created afterwards in {scope.name}.'