gcp-tasks-read-task-body
cloudtasks.tasks.list + cloudtasks.tasks.fullView allow a principal to read full task bodies in a Cloud Tasks queue - the data-plane read primitive that feeds credential-chains when tasks carry credentials.
match (effective permission)
{
"action": "cloudtasks.tasks.list",
"resource_type": "google.cloud.tasks.v2.Queue"
}
where
?principal also has effective cloudtasks.tasks.fullView on the same queue (confirmed via permission evaluator)
both permissions are not scoped to read only metadata; fullView must be present to unlock body read
emit
| source type | Identity |
|---|---|
| target type | Queue |
| source | <principal> |
| target | <Cloud Tasks queue in scope> |
| permissions | cloudtasks.tasks.list cloudtasks.tasks.fullView |
| conditions | iam_permission service_state |
| state logic | ACTIVE when the principal has effective cloudtasks.tasks.list AND cloudtasks.tasks.fullView on the queue AND the queue state is not DISABLED. CONDITIONAL(service_state) when the queue is PAUSED — tasks exist but no dispatches occur until resumed. Both permissions are required: tasks.list alone returns only task metadata/status; fullView unlocks the httpRequest.body field. |
Narrative
{principal.name} can list and read task bodies in {queue.name} (cloudtasks.tasks.list + cloudtasks.tasks.fullView). If {queue.name} carries tasks with credential material, credential-chains derives CanImpersonate for the embedded identity.
Raw rule rules/derived/gcp/tasks.yaml
id: gcp-tasks-read-task-body
emits: CanReadData
description: "cloudtasks.tasks.list + cloudtasks.tasks.fullView allow a principal to read full task bodies\
\ in a Cloud Tasks queue \u2014 the data-plane read primitive that feeds credential-chains when tasks\
\ carry credentials."
match_effective_permission:
action: cloudtasks.tasks.list
resource_type: google.cloud.tasks.v2.Queue
where:
- ?principal also has effective cloudtasks.tasks.fullView on the same queue (confirmed via permission
evaluator)
- both permissions are not scoped to read only metadata; fullView must be present to unlock body read
emit:
source_type: Identity
target_type: Queue
source: <principal>
target: <Cloud Tasks queue in scope>
permissions:
- cloudtasks.tasks.list
- cloudtasks.tasks.fullView
conditions:
- iam_permission
- service_state
state_logic: "ACTIVE when the principal has effective cloudtasks.tasks.list AND cloudtasks.tasks.fullView\
\ on the queue AND the queue state is not DISABLED. CONDITIONAL(service_state) when the queue is PAUSED\
\ \u2014 tasks exist but no dispatches occur until resumed. Both permissions are required: tasks.list\
\ alone returns only task metadata/status; fullView unlocks the httpRequest.body field."
derived_from:
- 'effective permission: cloudtasks.tasks.list on the queue'
- 'effective permission: cloudtasks.tasks.fullView on the queue'
false_positive_note: "cloudtasks.tasks.list without cloudtasks.tasks.fullView returns task metadata\
\ and status but NOT the body \u2014 do not emit ACTIVE without confirming fullView is also present.\
\ Tasks are ephemeral; a task may be deleted after dispatch and unavailable for read. Credential-chains\
\ owns the ContainsSecret / CredentialsFor roll-up; this rule asserts only the data-read capability.\
\ Org policy constraints/cloudtasks.allowedHttpTargets does not block reads, only creation of HTTP\
\ targets \u2014 this is a data-plane gate, not control-plane."
narrative: '{principal.name} can list and read task bodies in {queue.name} (cloudtasks.tasks.list +
cloudtasks.tasks.fullView). If {queue.name} carries tasks with credential material, credential-chains
derives CanImpersonate for the embedded identity.'