gcp-pd-snapshot-set-iam-policy

id: gcp-pd-snapshot-set-iam-policy
emits: CanModifyPolicy
description: A principal with compute.snapshots.setIamPolicy can grant themselves or a cross-project principal
  access to the snapshot, enabling data exfiltration or unauthorized cross-project reads.
applies_to:
- gcp
match_effective_permission:
  action: compute.snapshots.setIamPolicy
  resource_type: compute.googleapis.com/Snapshot
emit:
  source_type: Identity
  target_type: Snapshot
  source: <principal>
  target: <snapshot (IAM policy)>
  permissions:
  - compute.snapshots.setIamPolicy
  conditions:
  - iam_permission
  state_logic: "ACTIVE when compute.snapshots.setIamPolicy is confirmed in the effective permission set\
    \ for the snapshot (either per-snapshot binding or project-scope binding). No additional prerequisites\
    \ \u2014 IAM policy modification itself is always immediately effective once the permission is held.\
    \ Downstream CanExfiltrate/CanReadData edges are CONDITIONAL on the attacker also having compute.snapshots.useReadOnly\
    \ + compute.disks.create in a destination project (see gcp-pd-snapshot-use-cross-project)."
  false_positive_note: "compute.snapshots.setIamPolicy granted at project scope applies to ALL snapshots\
    \ in the project. Per-snapshot grants scope to one snapshot \u2014 honor the scope boundary. This\
    \ rule models the ability to grant access, not the act of reading data; the exfiltration chain requires\
    \ the subsequent useReadOnly + disks.create permissions in a destination project."
  derived_from:
  - <compute.snapshots.setIamPolicy effective permission on snapshot>
  narrative: '{principal.name} can modify the IAM policy of {snapshot.name} (compute.snapshots.setIamPolicy),
    enabling a self-grant or a grant to a cross-project principal for compute.snapshots.useReadOnly, which
    allows full restoration and reading of the disk data.'