rage.fail

gcp-roles-update

derived gcp emits CanModifyPolicy

match (effective permission)

{ "action": "iam.roles.update", "resource_type": "google.iam.Role" }

where

?principal is bound to the custom role being edited

emit

source	`<principal>`
target	`<custom role>`
permissions	`iam.roles.update`

Narrative

{principal.name} can add permissions to custom role {role.name} it is bound to (iam.roles.update).

Raw rule rules/derived/gcp/identity-escalation.yaml

id: gcp-roles-update
emits: CanModifyPolicy
match_effective_permission:
  action: iam.roles.update
  resource_type: google.iam.Role
where:
- ?principal is bound to the custom role being edited
emit:
  source: <principal>
  target: <custom role>
  permissions:
  - iam.roles.update
  escalation: Add permissions to a custom role already bound to the attacker.
  narrative: '{principal.name} can add permissions to custom role {role.name} it is bound to (iam.roles.update).'