rage.fail

gcp-set-iam-policy-org

derived gcp emits CanGrantPermission

match (effective permission)

{ "action": "resourcemanager.organizations.setIamPolicy", "resource_type": "google.cloud.resourcemanager.Organization" }

emit

source	`<principal>`
target	`<organization>`
permissions	`resourcemanager.organizations.setIamPolicy`

Narrative

{principal.name} can set the organization IAM policy (resourcemanager.organizations.setIamPolicy) - full org control.

Raw rule rules/derived/gcp/identity-escalation.yaml

id: gcp-set-iam-policy-org
emits: CanGrantPermission
match_effective_permission:
  action: resourcemanager.organizations.setIamPolicy
  resource_type: google.cloud.resourcemanager.Organization
emit:
  source: <principal>
  target: <organization>
  permissions:
  - resourcemanager.organizations.setIamPolicy
  escalation: Org-level self-grant = organization takeover.
  narrative: "{principal.name} can set the organization IAM policy (resourcemanager.organizations.setIamPolicy)\
    \ \u2014 full org control."