gcp-sr-admin
roles/source.admin grants full control over a CSR repository, including push, IAM policy mutation, and deletion - implies CanModifyCode, CanModifyPolicy, CanRead, and CanModifyConfiguration.
match (effective permission)
{
"action": "source.repos.setIamPolicy",
"resource_type": "google.sourcerepo.Repository"
}
where
principal also holds source.repos.update AND source.repos.get on the same repository (i.e. roles/source.admin, not setIamPolicy alone)
emit
| source type | Identity |
|---|---|
| target type | ArtifactRepository |
| source | <principal> |
| target | <CSR repository in scope> |
| permissions | source.repos.get source.repos.list source.repos.update source.repos.setIamPolicy source.repos.getIamPolicy source.repos.updateRepoConfig source.repos.delete |
| state logic | ACTIVE when the combined set of admin permissions is effective. BLOCKED if an IAM deny policy denies any of the key permissions. Inherits weakest from contributing role binding. can-control::control-via-admin produces Controls(?principal -> ?repo) from this edge — not re-derived here. |
Narrative
{principal.name} has full administrative control over repository {repo.name} (roles/source.admin): can clone, push, set IAM policy, update configuration, and delete the repository. This implies CanModifyCode, CanModifyPolicy, CanRead, and CanModifyConfiguration on {repo.name}.
Raw rule rules/derived/gcp/sourcerepos.yaml
id: gcp-sr-admin
emits: CanAdminister
description: "roles/source.admin grants full control over a CSR repository, including push, IAM policy\
\ mutation, and deletion \u2014 implies CanModifyCode, CanModifyPolicy, CanRead, and CanModifyConfiguration."
match_effective_permission:
action: source.repos.setIamPolicy
resource_type: google.sourcerepo.Repository
where:
- principal also holds source.repos.update AND source.repos.get on the same repository (i.e. roles/source.admin,
not setIamPolicy alone)
emit:
source_type: Identity
target_type: ArtifactRepository
source: <principal>
target: <CSR repository in scope>
permissions:
- source.repos.get
- source.repos.list
- source.repos.update
- source.repos.setIamPolicy
- source.repos.getIamPolicy
- source.repos.updateRepoConfig
- source.repos.delete
conditions: []
state_logic: "ACTIVE when the combined set of admin permissions is effective. BLOCKED if an IAM deny\
\ policy denies any of the key permissions. Inherits weakest from contributing role binding. can-control::control-via-admin\
\ produces Controls(?principal -> ?repo) from this edge \u2014 not re-derived here."
confidence: 0.95
derived_from:
- effective roles/source.admin on <repo>
false_positive_note: setIamPolicy alone (without update + get) is CanModifyPolicy, not CanAdminister.
Verify the full permission set is granted before emitting CanAdminister. roles/source.admin at project
scope covers ALL repos; emit CanAdminister per repository.
narrative: '{principal.name} has full administrative control over repository {repo.name} (roles/source.admin):
can clone, push, set IAM policy, update configuration, and delete the repository. This implies CanModifyCode,
CanModifyPolicy, CanRead, and CanModifyConfiguration on {repo.name}.'