gcp-sr-read-is-can-read
source.repos.get (clone/read) grants read access to the full repository content, including any secrets committed to history and build-spec files that reveal SA references and deployment targets.
match (effective permission)
{
"action": "source.repos.get",
"resource_type": "google.sourcerepo.Repository"
}
emit
| source type | Identity |
|---|---|
| target type | ArtifactRepository |
| source | <principal> |
| target | <CSR repository in scope> |
| permissions | source.repos.get |
| state logic | ACTIVE when the permission is effective. BLOCKED if VPC-SC perimeter enforced and principal project is outside it. Low attack value by itself; primary path-finding value is for ContainsSecret + credential-chains pivots and recon of build-spec SA references. |
Narrative
{principal.name} can clone (read) repository {repo.name} (source.repos.get), including the full commit history and any secrets accidentally committed. If the repo is annotated ContainsSecret, this CanRead chains to CanReadSecret via credential-chains.
Raw rule rules/derived/gcp/sourcerepos.yaml
id: gcp-sr-read-is-can-read
emits: CanRead
description: source.repos.get (clone/read) grants read access to the full repository content, including
any secrets committed to history and build-spec files that reveal SA references and deployment targets.
match_effective_permission:
action: source.repos.get
resource_type: google.sourcerepo.Repository
emit:
source_type: Identity
target_type: ArtifactRepository
source: <principal>
target: <CSR repository in scope>
permissions:
- source.repos.get
conditions: []
state_logic: ACTIVE when the permission is effective. BLOCKED if VPC-SC perimeter enforced and principal
project is outside it. Low attack value by itself; primary path-finding value is for ContainsSecret
+ credential-chains pivots and recon of build-spec SA references.
confidence: 0.8
derived_from:
- 'effective permission: source.repos.get on <repo>'
false_positive_note: "Read alone is not escalation \u2014 do not include this edge in privilege- escalation\
\ path queries without a ContainsSecret annotation on the repo. The escalation consequence (CanReadSecret\
\ -> CredentialsFor -> CanImpersonate) is credential-chains' job; this edge is the reachability fact."
narrative: '{principal.name} can clone (read) repository {repo.name} (source.repos.get), including the
full commit history and any secrets accidentally committed. If the repo is annotated ContainsSecret,
this CanRead chains to CanReadSecret via credential-chains.'