rage.fail

gcp-sa-set-iam-policy

derived gcp emits CanModifyTrust

match (effective permission)

{ "action": "iam.serviceAccounts.setIamPolicy", "resource_type": "google.iam.ServiceAccount" }

emit

source type	`Identity`
source	`<principal>`
target	`<service account>`
permissions	`iam.serviceAccounts.setIamPolicy`

Narrative

{principal.name} can set the IAM policy of {sa.name} (iam.serviceAccounts.setIamPolicy) and grant itself Token Creator, then impersonate it.

Raw rule rules/derived/gcp/identity-escalation.yaml

id: gcp-sa-set-iam-policy
emits: CanModifyTrust
match_effective_permission:
  action: iam.serviceAccounts.setIamPolicy
  resource_type: google.iam.ServiceAccount
emit:
  source_type: Identity
  source: <principal>
  target: <service account>
  permissions:
  - iam.serviceAccounts.setIamPolicy
  escalation: Grant self roles/iam.serviceAccountTokenCreator on the SA, then impersonate.
  narrative: '{principal.name} can set the IAM policy of {sa.name} (iam.serviceAccounts.setIamPolicy)
    and grant itself Token Creator, then impersonate it.'