rage.fail

gcp-run-update-code

derived gcp emits CanModifyCode

match (effective permission)

{ "action": "run.services.update", "resource_type": "google.cloud.run.Service" }

where

action is run.services.update (service) OR run.jobs.update (job) OR run.workerpools.update (worker pool) on ?resource

emit

source type	`Identity`
source	`<principal>`
target	`<Cloud Run service/job/worker-pool in scope>`
permissions	`run.services.update` `run.jobs.update` `run.workerpools.update`

Narrative

{principal.name} can update {resource.name} (run.services.update / run.jobs.update), deploying a new revision with an arbitrary container image.

Raw rule rules/derived/gcp/cloudrun.yaml

id: gcp-run-update-code
emits: CanModifyCode
match_effective_permission:
  action: run.services.update
  resource_type: google.cloud.run.Service
alt_permission: run.jobs.update
where:
- action is run.services.update (service) OR run.jobs.update (job) OR run.workerpools.update (worker pool)
  on ?resource
emit:
  source_type: Identity
  source: <principal>
  target: <Cloud Run service/job/worker-pool in scope>
  permissions:
  - run.services.update
  - run.jobs.update
  - run.workerpools.update
  escalation: Deploy a new revision with an attacker-controlled container image / entrypoint.
  false_positive_note: run.*.update swaps the image but the resource still executes as its EXISTING runtime
    SA unless the SA is also changed (which needs actAs). Do not attribute an arbitrary SA.
  narrative: '{principal.name} can update {resource.name} (run.services.update / run.jobs.update), deploying
    a new revision with an arbitrary container image.'