gcp-scc-read-findings-only

id: gcp-scc-read-findings-only
emits: CanRead
description: Principal with securitycenter.findings.list can enumerate all SCC findings across their scope,
  revealing exploitable misconfigurations.
match:
- - principal: null
  - HasPermission
  - scc: null
where:
- node_type(?scc) == SecurityService
- ?scc.provider_type in ['google.securitycenter.OrganizationSettings', 'google.securitycenter.ProjectSettings']
- ?principal has EFFECTIVE securitycenter.findings.list at the scope of ?scc
emit:
  source_type: Identity
  target_type: SecurityService
  source: ?principal
  target: ?scc
  permissions:
  - securitycenter.findings.list
  conditions:
  - iam_permission
  state_logic: ACTIVE when ?principal holds effective securitycenter.findings.list at ?scc.scope. BLOCKED
    if an IAM deny policy or VPC-SC perimeter denies securitycenter.findings.list. Confidence 0.70 reflects
    that read access is low direct attack value without a subsequent exploitation step.
  confidence: 0.7
  derived_from:
  - HasPermission(?principal, securitycenter.findings.list, ?scc)
  false_positive_note: Read access to SCC findings alone provides reconnaissance of finding categories
    (ACCOUNT_COMPROMISED, OPEN_FIREWALL, SERVICE_ACCOUNT_KEY_CREATED, etc.) but does not include asset
    inventory and does not suppress findings or grant access. Many legitimate roles (SOC analysts, security
    engineers, audit accounts) hold this permission. Confidence is 0.70. SCC findings do NOT contain credentials
    or secret material. This is RECON-only; do NOT chain to CanExecuteAs, CanEnterProject, or CanEscalateTo.
  narrative: '{principal.name} can list SCC findings at {scc.scope} (securitycenter.findings.list). This
    reveals finding categories and resource misconfigurations across all projects in scope (e.g., ACCOUNT_COMPROMISED,
    OPEN_FIREWALL, SERVICE_ACCOUNT_KEY_CREATED findings) without requiring direct read access to those
    resources. This reconnaissance capability accelerates identification of lateral movement targets and
    exploitable misconfigurations.'