gcp-tasks-set-iam-policy
cloudtasks.queues.setIamPolicy lets an attacker grant itself cloudtasks.tasks.create (task enqueue) or cloudtasks.queues.update (queue config change) on the queue, completing either the trigger-escalation or the SA-swap path.
match (effective permission)
{
"action": "cloudtasks.queues.setIamPolicy",
"resource_type": "google.cloud.tasks.v2.Queue"
}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <Cloud Tasks queue IAM allow policy> |
| permissions | cloudtasks.queues.setIamPolicy |
| conditions | iam_permission |
| state logic | ACTIVE when the principal has effective cloudtasks.queues.setIamPolicy on the queue. |
Narrative
{principal.name} can set the IAM policy of {queue.name} (cloudtasks.queues.setIamPolicy), granting itself task-create or queue-update rights and completing a trigger-escalation or SA-swap path.
Raw rule rules/derived/gcp/tasks.yaml
id: gcp-tasks-set-iam-policy
emits: CanModifyPolicy
description: cloudtasks.queues.setIamPolicy lets an attacker grant itself cloudtasks.tasks.create (task
enqueue) or cloudtasks.queues.update (queue config change) on the queue, completing either the trigger-escalation
or the SA-swap path.
match_effective_permission:
action: cloudtasks.queues.setIamPolicy
resource_type: google.cloud.tasks.v2.Queue
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <Cloud Tasks queue IAM allow policy>
permissions:
- cloudtasks.queues.setIamPolicy
conditions:
- iam_permission
state_logic: ACTIVE when the principal has effective cloudtasks.queues.setIamPolicy on the queue.
derived_from:
- 'effective permission: cloudtasks.queues.setIamPolicy on the queue resource'
false_positive_note: "setIamPolicy modifies the resource-level IAM allow policy. IAM deny policies or\
\ org-policy constraints at project/folder/org scope that override the queue-level grant still apply\
\ \u2014 honor deny-before-allow evaluation. A self-grant of cloudtasks.tasks.create feeds the CanWriteData\
\ \u2192 messaging-chains trigger path; a self-grant of cloudtasks.queues.update feeds the CanModifyConfiguration\
\ path. The escalation consequence is can-execute-as / messaging-chains \u2014 cited not re-derived\
\ here."
narrative: '{principal.name} can set the IAM policy of {queue.name} (cloudtasks.queues.setIamPolicy),
granting itself task-create or queue-update rights and completing a trigger-escalation or SA-swap
path.'