gcp-secretmanager-escalate-via-credentialsfor
Reading a secret that yields credentials for a strictly more-privileged identity is escalation.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
{'principal': None}
CanReadSecret {'secret': None}
{'secret': None} CredentialsFor {'identity': None}
where
?identity.privilege_level > ?principal.privilege_level
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <credentialed identity> |
| permissions | secretmanager.versions.access |
| conditions | iam_permission resource_policy key_permission |
| state logic | Inherits CanReadSecret state (CMEK secrets remain CONDITIONAL(key_permission) until the service-agent grant is confirmed). |
Narrative
{principal.name} can escalate to {identity.name} by reading secret {secret.name}, whose payload is a credential for {identity.name}.
Raw rule rules/derived/gcp/secretmanager.yaml
id: gcp-secretmanager-escalate-via-credentialsfor
emits: CanEscalateTo
description: Reading a secret that yields credentials for a strictly more-privileged identity is escalation.
match:
- - principal: null
- CanReadSecret
- secret: null
- - secret: null
- CredentialsFor
- identity: null
where:
- ?identity.privilege_level > ?principal.privilege_level
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <credentialed identity>
permissions:
- secretmanager.versions.access
conditions:
- iam_permission
- resource_policy
- key_permission
state_logic: Inherits CanReadSecret state (CMEK secrets remain CONDITIONAL(key_permission) until the
service-agent grant is confirmed).
confidence: min(contributing_confidences) * 0.95
derived_from:
- <CanReadSecret edge_id>
- <CredentialsFor edge_id>
false_positive_note: Only emit when the credentialed identity is strictly more privileged than the caller;
a secret holding creds for a same/lower-privilege identity is lateral, not escalation. Inherits state
(and CMEK gating) from CanReadSecret.
narrative: '{principal.name} can escalate to {identity.name} by reading secret {secret.name}, whose
payload is a credential for {identity.name}.'