gcp-scc-explicit-muteconfig-write
Principal holds effective securitycenter.muteconfigs.create or .update permission.
match (effective permission)
{
"action": [
"securitycenter.muteconfigs.create",
"securitycenter.muteconfigs.update"
],
"resource_type": [
"google.securitycenter.OrganizationSettings",
"google.securitycenter.ProjectSettings"
]
}
emit
| source type | Identity |
|---|---|
| target type | SecurityService |
| source | ?principal |
| target | ?scc |
| permissions | securitycenter.muteconfigs.create securitycenter.muteconfigs.update |
| conditions | iam_permission service_state |
| state logic | HasPermission is ACTIVE when the principal holds either permission. Note: SCC Premium tier is required to create/update mute configs; Standard tier will have this permission ignored by the SCC API. The service_state condition allows derived rules to gate on Premium tier availability. |
Narrative
{principal.name} holds effective securitycenter.muteconfigs.create or .update permission at {scc.scope}, enabling rule-based mute config creation/modification.
Raw rule rules/explicit/gcp-scc.yaml
id: gcp-scc-explicit-muteconfig-write
emits: HasPermission
description: Principal holds effective securitycenter.muteconfigs.create or .update permission.
match_effective_permission:
action:
- securitycenter.muteconfigs.create
- securitycenter.muteconfigs.update
resource_type:
- google.securitycenter.OrganizationSettings
- google.securitycenter.ProjectSettings
emit:
source_type: Identity
target_type: SecurityService
source: ?principal
target: ?scc
permissions:
- securitycenter.muteconfigs.create
- securitycenter.muteconfigs.update
conditions:
- iam_permission
- service_state
confidence: 0.9
state_logic: 'HasPermission is ACTIVE when the principal holds either permission. Note: SCC Premium
tier is required to create/update mute configs; Standard tier will have this permission ignored by
the SCC API. The service_state condition allows derived rules to gate on Premium tier availability.'
narrative: '{principal.name} holds effective securitycenter.muteconfigs.create or .update permission
at {scc.scope}, enabling rule-based mute config creation/modification.'