gcp-sr-project-config-update
source.repos.updateProjectConfig controls project-wide CSR settings, including whether Cloud Build automatic triggers fire - a meta-gate on CSR-triggered CI/CD paths in the project.
match (effective permission)
{
"action": "source.repos.updateProjectConfig",
"resource_type": "google.cloudresourcemanager.Project"
}
emit
| source type | Identity |
|---|---|
| target type | Project |
| source | <principal> |
| target | <GCP Project containing CSR repositories> |
| permissions | source.repos.updateProjectConfig |
| state logic | ACTIVE when the permission is effective. This permission controls project-wide CSR settings (auto-trigger enabling, push notification configuration). While it does not directly push code, changing these settings can disable or re-enable Cloud Build automatic triggers firing across all repositories in the project, gating or enabling the entire CSR-to-Build CI/CD pathway. BLOCKED if IAM deny or org policy prevents the call. Inherit weakest from contributing role binding. |
Narrative
{principal.name} can update the project-wide configuration of Cloud Source Repositories (source.repos.updateProjectConfig), including whether automatic Cloud Build triggers fire across all repositories in {project.name}. Modifying this setting can disable or re-enable the entire CSR-triggered CI/CD pathway, affecting the attack surface of all CSR repositories in the project.
Raw rule rules/derived/gcp/sourcerepos.yaml
id: gcp-sr-project-config-update
emits: CanModifyConfiguration
description: "source.repos.updateProjectConfig controls project-wide CSR settings, including whether Cloud\
\ Build automatic triggers fire \u2014 a meta-gate on CSR-triggered CI/CD paths in the project."
match_effective_permission:
action: source.repos.updateProjectConfig
resource_type: google.cloudresourcemanager.Project
emit:
source_type: Identity
target_type: Project
source: <principal>
target: <GCP Project containing CSR repositories>
permissions:
- source.repos.updateProjectConfig
conditions: []
state_logic: ACTIVE when the permission is effective. This permission controls project-wide CSR settings
(auto-trigger enabling, push notification configuration). While it does not directly push code, changing
these settings can disable or re-enable Cloud Build automatic triggers firing across all repositories
in the project, gating or enabling the entire CSR-to-Build CI/CD pathway. BLOCKED if IAM deny or org
policy prevents the call. Inherit weakest from contributing role binding.
confidence: 0.75
derived_from:
- 'effective permission: source.repos.updateProjectConfig on <project>'
false_positive_note: "CanModifyConfiguration on a project does NOT itself push code or directly arm\
\ any specific trigger; it is a meta-gate on whether triggers fire project-wide. An attacker with\
\ this permission can disable Cloud Build auto-triggers, preventing supply-chain CI/CD injection for\
\ a period (denial of service), or re-enable them if they were disabled. Treat as a configuration\
\ mutation that affects the gating of cicd-chains derivations at project scope. The downstream escalation\
\ (code push \u2192 code execution) is still cicd-chains'; this edge only records the project-config\
\ mutation capability."
narrative: '{principal.name} can update the project-wide configuration of Cloud Source Repositories
(source.repos.updateProjectConfig), including whether automatic Cloud Build triggers fire across all
repositories in {project.name}. Modifying this setting can disable or re-enable the entire CSR-triggered
CI/CD pathway, affecting the attack surface of all CSR repositories in the project.'