gcp-workflows-set-iam-policy
workflows.workflows.setIamPolicy lets an attacker grant itself roles/workflows.editor (CanModifyCode path) or roles/workflows.invoker (CanInvoke path) on the workflow.
match (effective permission)
{
"action": "workflows.workflows.setIamPolicy",
"resource_type": "google.workflows.type.Workflow"
}
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <workflow IAM allow policy> |
| permissions | workflows.workflows.setIamPolicy |
Narrative
{principal.name} can set the IAM policy of {workflow.name} (workflows.workflows.setIamPolicy), granting itself invoke or edit capabilities and completing a CanModifyCode or CanInvoke escalation path.
Raw rule rules/derived/gcp/workflows.yaml
id: gcp-workflows-set-iam-policy
emits: CanModifyPolicy
description: workflows.workflows.setIamPolicy lets an attacker grant itself roles/workflows.editor (CanModifyCode
path) or roles/workflows.invoker (CanInvoke path) on the workflow.
match_effective_permission:
action: workflows.workflows.setIamPolicy
resource_type: google.workflows.type.Workflow
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <workflow IAM allow policy>
permissions:
- workflows.workflows.setIamPolicy
derived_from:
- 'effective permission: workflows.workflows.setIamPolicy on the workflow resource'
escalation: Grant self roles/workflows.editor -> workflows.workflows.update (CanModifyCode) -> inject
steps -> CanExecuteAs(runtime SA). Or grant self roles/workflows.invoker -> workflows.executions.create
(CanInvoke) -> trigger existing definition -> CanExecuteAs.
false_positive_note: "setIamPolicy on the workflow resource modifies the resource-level IAM allow policy.\
\ This does NOT override project-level org policies or IAM deny policies that may block the grant.\
\ Conditional IAM bindings on the target policy (e.g. requiring MFA or a specific resource tag) constrain\
\ the self-grant further \u2014 honor them."
narrative: '{principal.name} can set the IAM policy of {workflow.name} (workflows.workflows.setIamPolicy),
granting itself invoke or edit capabilities and completing a CanModifyCode or CanInvoke escalation
path.'