gcp-psc-delete-endpoint
An identity with compute.forwardingRules.delete on a PSC consumer endpoint (forwarding rule with purpose=PRIVATE_SERVICE_CONNECT) can remove it. This is a destructive capability that disrupts private connectivity to the producer service, purely an availability impact rather than privilege escalation or data access.
match (effective permission)
{
"action": "compute.forwardingRules.delete",
"resource_type": "compute.googleapis.com/ForwardingRule"
}
where
target forwardingRule has purpose=PRIVATE_SERVICE_CONNECT
emit
| source type | Identity |
|---|---|
| target type | PrivateEndpoint |
| source | <principal> |
| target | <PSC consumer forwarding rule> |
| permissions | compute.forwardingRules.delete |
| conditions | iam_permission |
Narrative
{principal.name} can delete PSC consumer forwarding rule {forwarding_rule.name} (compute.forwardingRules.delete), disrupting private connectivity to the producer service {service_attachment.name}.
Raw rule rules/explicit/gcp-psc.yaml
id: gcp-psc-delete-endpoint
emits: CanDelete
applies_to:
- gcp
description: An identity with compute.forwardingRules.delete on a PSC consumer endpoint (forwarding rule
with purpose=PRIVATE_SERVICE_CONNECT) can remove it. This is a destructive capability that disrupts
private connectivity to the producer service, purely an availability impact rather than privilege escalation
or data access.
match_effective_permission:
action: compute.forwardingRules.delete
resource_type: compute.googleapis.com/ForwardingRule
where:
- target forwardingRule has purpose=PRIVATE_SERVICE_CONNECT
emit:
source_type: Identity
target_type: PrivateEndpoint
source: <principal>
target: <PSC consumer forwarding rule>
permissions:
- compute.forwardingRules.delete
conditions:
- iam_permission
api_source: compute.forwardingRules.delete (effective permission)
evidence_field: iam.compute.forwardingRules.delete
narrative: '{principal.name} can delete PSC consumer forwarding rule {forwarding_rule.name} (compute.forwardingRules.delete),
disrupting private connectivity to the producer service {service_attachment.name}.'