rage.fail

gcp-run-metadata-token

Code running in a Cloud Run container mints tokens for the runtime SA from the metadata server.

derived gcp emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

?principal CanExecuteAs ?sa

where

?principal reached code execution inside a Cloud Run container running as ?sa

emit

source	`<principal / container>`
target	`<runtime service account>`

Narrative

Code running in {resource.name} can read the metadata server to obtain an OAuth access token for {sa.name} (ExposesCredential).

Raw rule rules/derived/gcp/cloudrun.yaml

id: gcp-run-metadata-token
emits: CanRetrieveToken
description: Code running in a Cloud Run container mints tokens for the runtime SA from the metadata server.
match:
- - ?principal
  - CanExecuteAs
  - ?sa
where:
- ?principal reached code execution inside a Cloud Run container running as ?sa
emit:
  source: <principal / container>
  target: <runtime service account>
  permissions: []
  note: 'metadata endpoint: http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
    (header Metadata-Flavor: Google). Also emit ExposesCredential(container -> SA).'
  derived_from:
  - <CanExecuteAs edge_id>
  narrative: Code running in {resource.name} can read the metadata server to obtain an OAuth access token
    for {sa.name} (ExposesCredential).