gcp-pubsub-set-iam-policy-topic

id: gcp-pubsub-set-iam-policy-topic
emits: CanModifyPolicy
description: pubsub.topics.setIamPolicy allows rewriting the topic IAM policy, enabling self-grant of
  pubsub.topics.publish and the downstream trigger chain.
match:
- match_effective_permission:
    action: pubsub.topics.setIamPolicy
    resource_type: google.pubsub.Topic
emit:
  source_type: Identity
  target_type: Topic
  source: <principal>
  target: <Pub/Sub topic node>
  permissions:
  - pubsub.topics.setIamPolicy
  conditions:
  - iam_permission
  state_logic: ACTIVE when effective pubsub.topics.setIamPolicy is granted and no IAM deny policy or org
    policy constraint blocks the action. BLOCKED by IAM deny or by an org policy that restricts IAM policy
    mutation at this scope.
  confidence: 0.9
  derived_from:
  - 'effective-permission: pubsub.topics.setIamPolicy on topic'
  false_positive_note: "pubsub.topics.setIamPolicy modifies only the topic's own IAM policy, not the subscription's.\
    \ The attacker can self-grant pubsub.topics.publish but cannot self-grant consume access to existing\
    \ subscriptions via this permission alone. The downstream CanModifyPolicy \u2192 CanWriteData \u2192\
    \ CanTrigger escalation requires a push subscription already to exist and be active (unless the attacker\
    \ also has pubsub.subscriptions.create). Org policy (constraints/iam.allowedPolicyMemberDomains) may\
    \ prevent adding external members via setIamPolicy."
  narrative: '{principal.name} can rewrite the IAM policy of Pub/Sub topic {topic.name} (pubsub.topics.setIamPolicy);
    an attacker can self-grant pubsub.topics.publish and then trigger any push-subscription consumer via
    the Phase-10 trigger chain.'