gcp-orgpolicy-modify-vm-external-ip-guardrail

Weaken compute.vmExternalIpAccess to allow assigning public IPs to VMs (internet exposure).

derived gcp emits CanModifyPolicy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`*`
source	`?principal`
target	`?orgpolicy`
permissions	`orgpolicy.policy.set`
conditions	`guardrail_enforced` `iam_permission`
state logic	ACTIVE for the CanModifyPolicy when set is unconditional and the constraint is enforced at ?scope. Downstream ExposedToInternet(VM) upgrade deferred to hierarchy-chains; it further requires the principal to actually assign a public IP (compute.instances.* on the VM) for the exposure to realize.

source type

Identity

target type

*

source

?principal

target

?orgpolicy

permissions

orgpolicy.policy.set

conditions

guardrail_enforced iam_permission

state logic

ACTIVE for the CanModifyPolicy when set is unconditional and the constraint is enforced at ?scope. Downstream ExposedToInternet(VM) upgrade deferred to hierarchy-chains; it further requires the principal to actually assign a public IP (compute.instances.* on the VM) for the exposure to realize.

Narrative

{principal.name} can weaken constraints/compute.vmExternalIpAccess at {scope.name}, re-enabling public-IP assignment for Compute Engine VMs in {scope.name} (internet exposure).

Raw rule rules/derived/gcp/orgpolicy.yaml

id: gcp-orgpolicy-modify-vm-external-ip-guardrail
emits: CanModifyPolicy
description: Weaken compute.vmExternalIpAccess to allow assigning public IPs to VMs (internet exposure).
match:
- - principal: null
  - CanModifyPolicy
  - orgpolicy: null
where:
- node_type(?orgpolicy) == OrganizationPolicy
- ?orgpolicy.constraint == 'constraints/compute.vmExternalIpAccess'
- ?orgpolicy is ENFORCED at/inherited-to ?scope (list constraint; denyAll or restrictive allowedValues)
- ?principal has EFFECTIVE orgpolicy.policy.set at ?scope
emit:
  source_type: Identity
  target_type: '*'
  source: ?principal
  target: ?orgpolicy
  permissions:
  - orgpolicy.policy.set
  gates:
  - 'ExposedToInternet(Compute)  # VM public-IP exposure, emitted BLOCKED by GCE research while enforced'
  conditions:
  - guardrail_enforced
  - iam_permission
  state_logic: ACTIVE for the CanModifyPolicy when set is unconditional and the constraint is enforced
    at ?scope. Downstream ExposedToInternet(VM) upgrade deferred to hierarchy-chains; it further requires
    the principal to actually assign a public IP (compute.instances.* on the VM) for the exposure to realize.
  confidence: min(contributing_confidences)
  derived_from:
  - ?principal CanModifyPolicy ?orgpolicy
  - guardrail-removal-upgrades-blocked (hierarchy-chains.yaml)
  false_positive_note: This constraint gates public-IP ASSIGNMENT, not existing exposure. Fire only when
    an ExposedToInternet(Compute) edge is BLOCKED by THIS policy. Widening allowedValues to include the
    attacker's target VMs is equivalent to removal.
  narrative: '{principal.name} can weaken constraints/compute.vmExternalIpAccess at {scope.name}, re-enabling
    public-IP assignment for Compute Engine VMs in {scope.name} (internet exposure).'