rage.fail

gcp-secretmanager-can-modify-policy

explicit gcp emits CanModifyPolicy

match (effective permission)

{ "action": "secretmanager.secrets.setIamPolicy", "resource_type": "google.secretmanager.Secret" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<secret allow policy node>`
permissions	`secretmanager.secrets.setIamPolicy`

Narrative

{principal.name} can modify the IAM allow policy of {secret.name} (secretmanager.secrets.setIamPolicy).

Raw rule rules/explicit/gcp-secretmanager.yaml

id: gcp-secretmanager-can-modify-policy
emits: CanModifyPolicy
applies_to:
- gcp
match_effective_permission:
  action: secretmanager.secrets.setIamPolicy
  resource_type: google.secretmanager.Secret
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <secret allow policy node>
  permissions:
  - secretmanager.secrets.setIamPolicy
  narrative: '{principal.name} can modify the IAM allow policy of {secret.name} (secretmanager.secrets.setIamPolicy).'