gcp-psc-modify-acceptlist-cross-project
An identity with compute.serviceAttachments.update can modify the consumerAcceptLists of a Service Attachment (or change connectionPreference to ACCEPT_AUTOMATIC), adding unauthorized consumer projects and granting them private access to the producer's Internal LB backend.
match (effective permission)
{
"action": "compute.serviceAttachments.update",
"resource_type": "compute.googleapis.com/ServiceAttachment"
}
emit
| source type | Identity |
|---|---|
| target type | PrivateEndpoint |
| source | <principal> |
| target | <Service Attachment> |
| permissions | compute.serviceAttachments.update |
| conditions | iam_permission |
| state logic | ACTIVE if ?principal holds compute.serviceAttachments.update at the effective scope; CONDITIONAL(iam_permission) if the effective permission is uncertain (e.g. conditional IAM binding not yet evaluated). |
Narrative
{principal.name} can modify {service_attachment.name}'s consumerAcceptLists (compute.serviceAttachments.update), adding an attacker-controlled consumer project and opening private access to the producer backend for that project.
Raw rule rules/derived/gcp/psc.yaml
id: gcp-psc-modify-acceptlist-cross-project
emits: CanModifyConfiguration
description: An identity with compute.serviceAttachments.update can modify the consumerAcceptLists of
a Service Attachment (or change connectionPreference to ACCEPT_AUTOMATIC), adding unauthorized consumer
projects and granting them private access to the producer's Internal LB backend.
match_effective_permission:
action: compute.serviceAttachments.update
resource_type: compute.googleapis.com/ServiceAttachment
emit:
source_type: Identity
target_type: PrivateEndpoint
source: <principal>
target: <Service Attachment>
permissions:
- compute.serviceAttachments.update
conditions:
- iam_permission
state_logic: ACTIVE if ?principal holds compute.serviceAttachments.update at the effective scope; CONDITIONAL(iam_permission)
if the effective permission is uncertain (e.g. conditional IAM binding not yet evaluated).
derived_from:
- '<effective permission: compute.serviceAttachments.update on producer project>'
false_positive_note: "compute.serviceAttachments.update is included in roles/compute.networkAdmin and\
\ roles/compute.admin; a narrower custom role may or may not include it \u2014 honor effective permission\
\ evaluation. Updating the acceptlist grants cross-project network access but does NOT bypass the\
\ producer backend's IAM or app-layer auth."
narrative: '{principal.name} can modify {service_attachment.name}''s consumerAcceptLists (compute.serviceAttachments.update),
adding an attacker-controlled consumer project and opening private access to the producer backend
for that project.'