rage.fail

gcp-set-iam-policy-resource

derived gcp emits CanModifyPolicy

match (effective permission)

{ "action": "*.setIamPolicy", "resource_type": "*" }

where

action is a resource-level setIamPolicy (e.g. storage.buckets.setIamPolicy, pubsub.topics.setIamPolicy)

emit

source	`<principal>`
target	`<resource in scope>`
permissions	`<resource>.setIamPolicy`

Narrative

{principal.name} can set the IAM policy of {resource.name}, granting itself access to that resource.

Raw rule rules/derived/gcp/identity-escalation.yaml

id: gcp-set-iam-policy-resource
emits: CanModifyPolicy
match_effective_permission:
  action: '*.setIamPolicy'
  resource_type: '*'
where:
- action is a resource-level setIamPolicy (e.g. storage.buckets.setIamPolicy, pubsub.topics.setIamPolicy)
emit:
  source: <principal>
  target: <resource in scope>
  permissions:
  - <resource>.setIamPolicy
  narrative: '{principal.name} can set the IAM policy of {resource.name}, granting itself access to that
    resource.'