gcp-workflows-update-definition
workflows.workflows.update replaces the workflow's YAML/JSON definition, enabling injection of arbitrary Google API calls or HTTP steps that run as the runtime SA.
match (effective permission)
{
"action": "workflows.workflows.update",
"resource_type": "google.workflows.type.Workflow"
}
emit
| source type | Identity |
|---|---|
| target type | Messaging |
| source | <principal> |
| target | <workflow in scope> |
| permissions | workflows.workflows.update |
Narrative
{principal.name} can replace the definition of {workflow.name} (workflows.workflows.update), injecting arbitrary steps (HTTP calls, Google API calls) that run as the runtime service account.
Raw rule rules/derived/gcp/workflows.yaml
id: gcp-workflows-update-definition
emits: CanModifyCode
description: workflows.workflows.update replaces the workflow's YAML/JSON definition, enabling injection
of arbitrary Google API calls or HTTP steps that run as the runtime SA.
match_effective_permission:
action: workflows.workflows.update
resource_type: google.workflows.type.Workflow
emit:
source_type: Identity
target_type: Messaging
source: <principal>
target: <workflow in scope>
permissions:
- workflows.workflows.update
derived_from:
- 'effective permission: workflows.workflows.update on the workflow resource'
false_positive_note: "workflows.workflows.update controls the definition (source YAML/JSON). Updating\
\ the definition does NOT immediately run the new version \u2014 the next execution activates it.\
\ Without an execution path (direct executions.create OR a live Eventarc/Scheduler trigger bound to\
\ the workflow), the CanModifyCode escalation is CONDITIONAL(trigger_exists), not ACTIVE."
narrative: '{principal.name} can replace the definition of {workflow.name} (workflows.workflows.update),
injecting arbitrary steps (HTTP calls, Google API calls) that run as the runtime service account.'