gcp-secretmanager-version-add-tamper
secretmanager.versions.add writes a new payload version that downstream consumers will read.
match (effective permission)
{
"action": "secretmanager.versions.add",
"resource_type": "google.secretmanager.Secret"
}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <secret> |
| permissions | secretmanager.versions.add |
| conditions | iam_permission |
| state logic | ACTIVE for the write capability; downstream impact is CONDITIONAL on a consumer reading the latest/aliased version. BLOCKED under IAM/org/VPC-SC deny. |
Narrative
{principal.name} can add a new version to secret {secret.name} (secretmanager.versions.add), poisoning the payload consumers read.
Raw rule rules/derived/gcp/secretmanager.yaml
id: gcp-secretmanager-version-add-tamper
emits: CanModify
description: secretmanager.versions.add writes a new payload version that downstream consumers will read.
match_effective_permission:
action: secretmanager.versions.add
resource_type: google.secretmanager.Secret
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <secret>
permissions:
- secretmanager.versions.add
conditions:
- iam_permission
state_logic: ACTIVE for the write capability; downstream impact is CONDITIONAL on a consumer reading
the latest/aliased version. BLOCKED under IAM/org/VPC-SC deny.
confidence: min(contributing_confidences) * 0.85
derived_from:
- <effective secretmanager.versions.add grant>
false_positive_note: Tamper/supply-chain, not read. Only becomes an execution path when a workload reads
the poisoned version and treats it as config/code/credential. Controlling which version consumers
get may also need versions.enable/ disable/destroy and control of the version alias. Not escalation
by itself.
narrative: '{principal.name} can add a new version to secret {secret.name} (secretmanager.versions.add),
poisoning the payload consumers read.'