gcp-pubsub-set-iam-policy-subscription

pubsub.subscriptions.setIamPolicy allows rewriting the subscription IAM policy, enabling self-grant of pubsub.subscriptions.consume for credential/secret extraction via credential-chains.

derived gcp emits CanModifyPolicy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

emit

source type	`Identity`
target type	`Queue`
source	`<principal>`
target	`<Pub/Sub subscription node>`
permissions	`pubsub.subscriptions.setIamPolicy`
conditions	`iam_permission`
state logic	ACTIVE when effective pubsub.subscriptions.setIamPolicy is granted and no IAM deny policy or org policy constraint blocks the action. BLOCKED by IAM deny or by an org policy that restricts IAM policy mutation at this scope.

source type

Identity

target type

Queue

source

<principal>

target

<Pub/Sub subscription node>

permissions

pubsub.subscriptions.setIamPolicy

conditions

iam_permission

state logic

ACTIVE when effective pubsub.subscriptions.setIamPolicy is granted and no IAM deny policy or org policy constraint blocks the action. BLOCKED by IAM deny or by an org policy that restricts IAM policy mutation at this scope.

Narrative

{principal.name} can rewrite the IAM policy of Pub/Sub subscription {subscription.name} (pubsub.subscriptions.setIamPolicy); an attacker can self-grant pubsub.subscriptions.consume and then read credential-carrying messages via credential-chains.

Raw rule rules/derived/gcp/pubsub.yaml

id: gcp-pubsub-set-iam-policy-subscription
emits: CanModifyPolicy
description: pubsub.subscriptions.setIamPolicy allows rewriting the subscription IAM policy, enabling
  self-grant of pubsub.subscriptions.consume for credential/secret extraction via credential-chains.
match:
- match_effective_permission:
    action: pubsub.subscriptions.setIamPolicy
    resource_type: google.pubsub.Subscription
emit:
  source_type: Identity
  target_type: Queue
  source: <principal>
  target: <Pub/Sub subscription node>
  permissions:
  - pubsub.subscriptions.setIamPolicy
  conditions:
  - iam_permission
  state_logic: ACTIVE when effective pubsub.subscriptions.setIamPolicy is granted and no IAM deny policy
    or org policy constraint blocks the action. BLOCKED by IAM deny or by an org policy that restricts
    IAM policy mutation at this scope.
  confidence: 0.9
  derived_from:
  - 'effective-permission: pubsub.subscriptions.setIamPolicy on subscription'
  false_positive_note: pubsub.subscriptions.setIamPolicy modifies only the subscription's own IAM policy.
    The attacker can self-grant pubsub.subscriptions.consume on the subscription to read messages. Credential
    value only materializes if the subscription carries secret/credential material (ContainsSecret / ContainsCredential
    must be separately emitted). Org policy (constraints/iam.allowedPolicyMemberDomains) may prevent adding
    members via setIamPolicy.
  narrative: '{principal.name} can rewrite the IAM policy of Pub/Sub subscription {subscription.name}
    (pubsub.subscriptions.setIamPolicy); an attacker can self-grant pubsub.subscriptions.consume and then
    read credential-carrying messages via credential-chains.'