gcp-secretmanager-set-iam-self-grant
secrets.setIamPolicy lets a caller bind itself secretAccessor and then read the payload.
match (effective permission)
{
"action": "secretmanager.secrets.setIamPolicy",
"resource_type": "google.secretmanager.Secret"
}
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <principal (self)> |
| permissions | secretmanager.secrets.setIamPolicy |
| conditions | iam_permission |
| state logic | ACTIVE if setIamPolicy resolves on the secret; BLOCKED if an IAM deny / org policy denies it. Chains to CanReadSecret via a self-bound roles/secretmanager.secretAccessor. |
Narrative
{principal.name} can set the IAM policy of secret {secret.name} (secretmanager.secrets.setIamPolicy) and grant itself secretAccessor, then read the payload.
Raw rule rules/derived/gcp/secretmanager.yaml
id: gcp-secretmanager-set-iam-self-grant
emits: CanGrantPermission
description: secrets.setIamPolicy lets a caller bind itself secretAccessor and then read the payload.
match_effective_permission:
action: secretmanager.secrets.setIamPolicy
resource_type: google.secretmanager.Secret
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <principal (self)>
permissions:
- secretmanager.secrets.setIamPolicy
conditions:
- iam_permission
state_logic: ACTIVE if setIamPolicy resolves on the secret; BLOCKED if an IAM deny / org policy denies
it. Chains to CanReadSecret via a self-bound roles/secretmanager.secretAccessor.
confidence: min(contributing_confidences) * 0.95
derived_from:
- <effective secretmanager.secrets.setIamPolicy grant>
false_positive_note: 'Escalation primitive: the caller can add a binding granting itself roles/secretmanager.secretAccessor
(or admin) on the secret, then read it. For a CMEK secret the service-agent KMS gate still applies
to the subsequent read. setIamPolicy is per-secret unless held at project/folder/org scope.'
narrative: '{principal.name} can set the IAM policy of secret {secret.name} (secretmanager.secrets.setIamPolicy)
and grant itself secretAccessor, then read the payload.'