gcp-vertexai-notebook-update-attach-sa

Update a Workbench instance's service account (notebooks.instances.update + actAs on new SA) so future code runs as the new SA.

derived gcp emits CanAttachIdentity

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanModifyConfiguration {'instance': None} {'principal': None} CanPassIdentity {'newsa': None}

where

node_type(?instance) == Notebook ?principal has EFFECTIVE notebooks.instances.update on ?instance (confirmed via CanModifyConfiguration edge) ?principal has iam.serviceAccounts.actAs on ?newsa ?newsa is compatible with the Workbench instance (GCE SA)

emit

source type	`Identity`
target type	`Notebook`
source	`<principal>`
target	`<Workbench notebook instance>`
permissions	`notebooks.instances.update` `iam.serviceAccounts.actAs`
conditions	`iam_permission` `role_compatibility` `service_state`
state logic	ACTIVE for the attach capability itself when CanModifyConfiguration (notebooks.instances.update) and CanPassIdentity (actAs on ?newsa) are confirmed. The instance must be restarted for the new SA to take effect (CONDITIONAL(service_state) for the downstream CanExecuteAs until the instance restarts and the attacker regains notebooks.instances.use). POTENTIAL(iam_permission) if actAs on ?newsa is not confirmed.

Narrative

{principal.name} can change the service account of Workbench instance {instance.name} to {newsa.name} (notebooks.instances.update + iam.serviceAccounts.actAs); the next instance start runs code as {newsa.name}.

Raw rule rules/derived/gcp/vertexai.yaml

id: gcp-vertexai-notebook-update-attach-sa
emits: CanAttachIdentity
description: Update a Workbench instance's service account (notebooks.instances.update + actAs on new
  SA) so future code runs as the new SA.
match:
- - principal: null
  - CanModifyConfiguration
  - instance: null
- - principal: null
  - CanPassIdentity
  - newsa: null
where:
- node_type(?instance) == Notebook
- ?principal has EFFECTIVE notebooks.instances.update on ?instance (confirmed via CanModifyConfiguration
  edge)
- ?principal has iam.serviceAccounts.actAs on ?newsa
- ?newsa is compatible with the Workbench instance (GCE SA)
emit:
  source_type: Identity
  target_type: Notebook
  source: <principal>
  target: <Workbench notebook instance>
  permissions:
  - notebooks.instances.update
  - iam.serviceAccounts.actAs
  conditions:
  - iam_permission
  - role_compatibility
  - service_state
  state_logic: ACTIVE for the attach capability itself when CanModifyConfiguration (notebooks.instances.update)
    and CanPassIdentity (actAs on ?newsa) are confirmed. The instance must be restarted for the new SA
    to take effect (CONDITIONAL(service_state) for the downstream CanExecuteAs until the instance restarts
    and the attacker regains notebooks.instances.use). POTENTIAL(iam_permission) if actAs on ?newsa is
    not confirmed.
  derived_from:
  - <CanModifyConfiguration edge_id>
  - <CanPassIdentity edge_id>
  false_positive_note: "The SA swap takes effect on the NEXT start of the instance; a currently running\
    \ instance still uses the old SA until restarted. The downstream CanExecuteAs via can-execute-as execute-as-via-config-identity-swap\
    \ fires off this edge \u2014 cited, not re-derived here. Requires actAs on the NEW SA; actAs on the\
    \ old SA is irrelevant. If the instance is managed by a GKE-style enforcement that prevents SA changes,\
    \ emit as BLOCKED."
  narrative: '{principal.name} can change the service account of Workbench instance {instance.name} to
    {newsa.name} (notebooks.instances.update + iam.serviceAccounts.actAs); the next instance start runs
    code as {newsa.name}.'