rage.fail

gcp-vertexai-exposes-runtime-sa-cred

A training job or Workbench notebook exposes its runtime SA credentials to any code it runs via the GCE metadata server.

derived gcp emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'compute': None} ExecutesAs {'sa': None}

where

node_type(?compute) in [Notebook, BatchJob, Workflow]

emit

source type	`Compute`
target type	`ServiceAccount`
source	`<training job / notebook instance>`
target	`<runtime service account>`

Narrative

{compute.name} exposes credentials of its runtime service account {sa.name} to any code it runs (GCE metadata server token endpoint).

Raw rule rules/derived/gcp/vertexai.yaml

id: gcp-vertexai-exposes-runtime-sa-cred
emits: ExposesCredential
description: A training job or Workbench notebook exposes its runtime SA credentials to any code it runs
  via the GCE metadata server.
match:
- - compute: null
  - ExecutesAs
  - sa: null
where:
- node_type(?compute) in [Notebook, BatchJob, Workflow]
emit:
  source_type: Compute
  target_type: ServiceAccount
  source: <training job / notebook instance>
  target: <runtime service account>
  permissions: []
  derived_from:
  - <ExecutesAs edge_id>
  note: "GCE metadata endpoint: http://metadata.google.internal/computeMetadata/v1/instance/ service-accounts/default/token\
    \ (header Metadata-Flavor: Google). Returns a short-lived OAuth 2.0 access token for the runtime SA.\
    \ Not a standalone escalation \u2014 value comes from a contributing CanModifyCode/CanCreateWorkloadAs/CanExecuteCommand\
    \ edge."
  false_positive_note: Not an escalation by itself; expresses the fact that code execution in the job
    equals holding the SA's token. Path value comes from a contributing execution edge.
  narrative: '{compute.name} exposes credentials of its runtime service account {sa.name} to any code
    it runs (GCE metadata server token endpoint).'