gcp-secretmanager-set-iam-policy
secrets.setIamPolicy writes the secret's IAM allow policy (grant self/others any access).
match (effective permission)
{
"action": "secretmanager.secrets.setIamPolicy",
"resource_type": "google.secretmanager.Secret"
}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <secret allow policy in scope> |
| permissions | secretmanager.secrets.setIamPolicy |
| conditions | iam_permission |
| state logic | ACTIVE if setIamPolicy resolves; BLOCKED under IAM/org deny. |
Narrative
{principal.name} can modify the IAM allow policy of secret {secret.name} (secretmanager.secrets.setIamPolicy).
Raw rule rules/derived/gcp/secretmanager.yaml
id: gcp-secretmanager-set-iam-policy
emits: CanModifyPolicy
description: secrets.setIamPolicy writes the secret's IAM allow policy (grant self/others any access).
match_effective_permission:
action: secretmanager.secrets.setIamPolicy
resource_type: google.secretmanager.Secret
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <secret allow policy in scope>
permissions:
- secretmanager.secrets.setIamPolicy
conditions:
- iam_permission
state_logic: ACTIVE if setIamPolicy resolves; BLOCKED under IAM/org deny.
confidence: min(contributing_confidences) * 0.97
derived_from:
- <effective secretmanager.secrets.setIamPolicy grant>
false_positive_note: Overlaps gcp-secretmanager-set-iam-self-grant (which is the escalation roll-up);
this records the raw policy-write capability on the secret's ResourcePolicy. De-dupe on edge_id if
both are consumed.
narrative: '{principal.name} can modify the IAM allow policy of secret {secret.name} (secretmanager.secrets.setIamPolicy).'