rage.fail

gcp-run-set-iam-policy

derived gcp emits CanModifyPolicy

match (effective permission)

{ "action": "run.services.setIamPolicy", "resource_type": "google.cloud.run.Service" }

where

action is run.services.setIamPolicy OR run.jobs.setIamPolicy OR run.workerpools.setIamPolicy on ?resource

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<Cloud Run service/job/worker-pool in scope>`
permissions	`run.services.setIamPolicy` `run.jobs.setIamPolicy` `run.workerpools.setIamPolicy`

Narrative

{principal.name} can set the IAM policy of {resource.name} (run.services.setIamPolicy) and self-grant run.invoker or expose it publicly.

Raw rule rules/derived/gcp/cloudrun.yaml

id: gcp-run-set-iam-policy
emits: CanModifyPolicy
match_effective_permission:
  action: run.services.setIamPolicy
  resource_type: google.cloud.run.Service
alt_permission: run.jobs.setIamPolicy
where:
- action is run.services.setIamPolicy OR run.jobs.setIamPolicy OR run.workerpools.setIamPolicy on ?resource
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <Cloud Run service/job/worker-pool in scope>
  permissions:
  - run.services.setIamPolicy
  - run.jobs.setIamPolicy
  - run.workerpools.setIamPolicy
  escalation: Grant self roles/run.invoker (completes an image-swap escalation) or bind allUsers for public
    exposure.
  narrative: '{principal.name} can set the IAM policy of {resource.name} (run.services.setIamPolicy) and
    self-grant run.invoker or expose it publicly.'