gcp-sr-set-iam-policy
source.repos.setIamPolicy grants full control over the repository's IAM allow policy - self-grant roles/source.writer, then push to arm Cloud Build triggers.
match (effective permission)
{
"action": "source.repos.setIamPolicy",
"resource_type": "google.sourcerepo.Repository"
}
emit
| source type | Identity |
|---|---|
| target type | ResourcePolicy |
| source | <principal> |
| target | <ResourcePolicy of the CSR repository> |
| permissions | source.repos.setIamPolicy |
| state logic | ACTIVE when the permission is effective. BLOCKED if an IAM deny policy denies source.repos.setIamPolicy (e.g. from a project-wide deny policy) or a VPC-SC perimeter rejects the API call. Inherit weakest from the contributing role binding. |
Narrative
{principal.name} can rewrite the IAM allow policy of repository {repo.name} (source.repos.setIamPolicy), granting itself roles/source.writer and then pushing a malicious commit to arm any Cloud Build push trigger watching a branch in {repo.name}.
Raw rule rules/derived/gcp/sourcerepos.yaml
id: gcp-sr-set-iam-policy
emits: CanModifyPolicy
description: "source.repos.setIamPolicy grants full control over the repository's IAM allow policy \u2014\
\ self-grant roles/source.writer, then push to arm Cloud Build triggers."
match_effective_permission:
action: source.repos.setIamPolicy
resource_type: google.sourcerepo.Repository
emit:
source_type: Identity
target_type: ResourcePolicy
source: <principal>
target: <ResourcePolicy of the CSR repository>
permissions:
- source.repos.setIamPolicy
conditions: []
state_logic: ACTIVE when the permission is effective. BLOCKED if an IAM deny policy denies source.repos.setIamPolicy
(e.g. from a project-wide deny policy) or a VPC-SC perimeter rejects the API call. Inherit weakest
from the contributing role binding.
confidence: 0.95
derived_from:
- 'effective permission: source.repos.setIamPolicy on <repo>'
false_positive_note: setIamPolicy at project scope (resourcemanager.projects.setIamPolicy) also implies
CanModifyPolicy on the repo transitively via gcp/identity- escalation::gcp-set-iam-policy-project.
This rule covers the repo-level setIamPolicy only. An IAM deny policy blocking setIamPolicy keeps
this BLOCKED regardless of what role bindings are present. The downstream CanModifyCode consequence
is derived by gcp-sr-policy-self-grant-write; do not emit CanModifyCode here.
narrative: '{principal.name} can rewrite the IAM allow policy of repository {repo.name} (source.repos.setIamPolicy),
granting itself roles/source.writer and then pushing a malicious commit to arm any Cloud Build push
trigger watching a branch in {repo.name}.'