rage.fail

gcp-set-iam-policy-project

derived gcp emits CanGrantPermission

match (effective permission)

{ "action": "resourcemanager.projects.setIamPolicy", "resource_type": "google.cloud.resourcemanager.Project" }

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<project>`
permissions	`resourcemanager.projects.setIamPolicy`

Narrative

{principal.name} can set the IAM policy of project {project.name} (resourcemanager.projects.setIamPolicy) and grant itself any role, including roles/owner.

Raw rule rules/derived/gcp/identity-escalation.yaml

id: gcp-set-iam-policy-project
emits: CanGrantPermission
match_effective_permission:
  action: resourcemanager.projects.setIamPolicy
  resource_type: google.cloud.resourcemanager.Project
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <project>
  permissions:
  - resourcemanager.projects.setIamPolicy
  escalation: Bind roles/owner to self at the project -> full project control.
  cross_boundary: emits Controls(project) via can-control roll-up
  narrative: '{principal.name} can set the IAM policy of project {project.name} (resourcemanager.projects.setIamPolicy)
    and grant itself any role, including roles/owner.'