gcp-psc-create-endpoint-opens-reach
An identity with compute.forwardingRules.create and compute.subnetworks.use on the target subnet can create a new PSC consumer forwarding rule pointing at any Service Attachment the consumer project is authorized to connect to. This opens a new private channel to the producer service that did not previously exist. compute.addresses.create is only required when reserving a static IP; PSC endpoints with ephemeral IPs do not require it.
match (effective permission)
{
"action": "compute.forwardingRules.create",
"resource_type": "compute.googleapis.com/ForwardingRule"
}
where
?principal also has compute.subnetworks.use on the PSC-enabled consumer subnet
the target Service Attachment admits the consumer project (ACCEPT_AUTOMATIC OR project in consumerAcceptLists)
emit
| source type | Identity |
|---|---|
| target type | PrivateEndpoint |
| source | <principal> |
| target | <PSC consumer VPC / subnet> |
| permissions | compute.forwardingRules.create compute.subnetworks.use |
| conditions | iam_permission service_state |
| state logic | ACTIVE if principal holds compute.forwardingRules.create and compute.subnetworks.use at the effective scope and the Service Attachment admits the consumer project. CONDITIONAL(iam_permission) if either permission is uncertain; POTENTIAL if the Service Attachment admission status is unknown. |
Narrative
{principal.name} can create a PSC consumer forwarding rule (compute.forwardingRules.create + compute.subnetworks.use) in {consumer_vpc.name}, opening a new private channel to the target producer Service Attachment without requiring internet egress.
Raw rule rules/derived/gcp/psc.yaml
id: gcp-psc-create-endpoint-opens-reach
emits: CanModifyConfiguration
description: An identity with compute.forwardingRules.create and compute.subnetworks.use on the target
subnet can create a new PSC consumer forwarding rule pointing at any Service Attachment the consumer
project is authorized to connect to. This opens a new private channel to the producer service that did
not previously exist. compute.addresses.create is only required when reserving a static IP; PSC endpoints
with ephemeral IPs do not require it.
match_effective_permission:
action: compute.forwardingRules.create
resource_type: compute.googleapis.com/ForwardingRule
where:
- ?principal also has compute.subnetworks.use on the PSC-enabled consumer subnet
- the target Service Attachment admits the consumer project (ACCEPT_AUTOMATIC OR project in consumerAcceptLists)
emit:
source_type: Identity
target_type: PrivateEndpoint
source: <principal>
target: <PSC consumer VPC / subnet>
permissions:
- compute.forwardingRules.create
- compute.subnetworks.use
conditions:
- iam_permission
- service_state
state_logic: ACTIVE if principal holds compute.forwardingRules.create and compute.subnetworks.use at
the effective scope and the Service Attachment admits the consumer project. CONDITIONAL(iam_permission)
if either permission is uncertain; POTENTIAL if the Service Attachment admission status is unknown.
derived_from:
- '<effective permission: compute.forwardingRules.create on consumer project>'
false_positive_note: "compute.forwardingRules.create without compute.subnetworks.use on the PSC-eligible\
\ subnet is insufficient \u2014 GCP requires both. Check subnetwork purpose=PRIVATE_SERVICE_CONNECT\
\ on the subnet. compute.addresses.create is only required when creating PSC endpoints with reserved/static\
\ IPs; dynamic IP PSC endpoints do not require this permission. If the target Service Attachment is\
\ ACCEPT_MANUAL and the consumer project is NOT in consumerAcceptLists, the connection will be PENDING,\
\ not ACCEPTED, so the PrivateReachability fact is not realized -> downgrade to POTENTIAL."
narrative: '{principal.name} can create a PSC consumer forwarding rule (compute.forwardingRules.create
+ compute.subnetworks.use) in {consumer_vpc.name}, opening a new private channel to the target producer
Service Attachment without requiring internet egress.'