rage.fail

gcp-secretmanager-can-read-secret

explicit gcp emits CanReadSecret

match (effective permission)

{ "action": "secretmanager.versions.access", "resource_type": "google.secretmanager.Secret" }

emit

source	`<principal>`
target	`<secret node>`
permissions	`secretmanager.versions.access`

Narrative

{principal.name} can read the payload of {secret.name} (secretmanager.versions.access).

Raw rule rules/explicit/gcp-secretmanager.yaml

id: gcp-secretmanager-can-read-secret
emits: CanReadSecret
applies_to:
- gcp
match_effective_permission:
  action: secretmanager.versions.access
  resource_type: google.secretmanager.Secret
emit:
  source: <principal>
  target: <secret node>
  api_source: "policy evaluation (Policy Analyzer) \u2014 NOT versions.access itself"
  permissions:
  - secretmanager.versions.access
  narrative: '{principal.name} can read the payload of {secret.name} (secretmanager.versions.access).'