rage.fail

gcp-set-iam-policy-folder

derived gcp emits CanGrantPermission

match (effective permission)

{ "action": "resourcemanager.folders.setIamPolicy", "resource_type": "google.cloud.resourcemanager.Folder" }

emit

source	`<principal>`
target	`<folder>`
permissions	`resourcemanager.folders.setIamPolicy`

Narrative

{principal.name} can set the IAM policy of folder {folder.name} and self-grant roles inherited by all child projects.

Raw rule rules/derived/gcp/identity-escalation.yaml

id: gcp-set-iam-policy-folder
emits: CanGrantPermission
match_effective_permission:
  action: resourcemanager.folders.setIamPolicy
  resource_type: google.cloud.resourcemanager.Folder
emit:
  source: <principal>
  target: <folder>
  permissions:
  - resourcemanager.folders.setIamPolicy
  escalation: Self-grant at folder -> control of all descendant projects.
  narrative: '{principal.name} can set the IAM policy of folder {folder.name} and self-grant roles inherited
    by all child projects.'