Derivation rules

deploymentmanager.deployments.create allows submitting a new deployment config; DM executes it as the cloudservices service agent. This is the CI/CD CanModifyCode primitive for DM.

deploymentmanager.deployments.update allows replacing an existing deployment's config; DM re-executes as the cloudservices SA, enabling injection into an already-provisioned deployment.

A principal with deploymentmanager.deployments.create submits an attacker-controlled config; DM actuates it as the Google APIs service agent, executing code (resource creation, setIamPolicy) as that SA's identity.

A principal with deploymentmanager.typeProviders.create registers a custom type provider backed by an attacker-controlled endpoint; a DM deployment using that type causes DM to call the endpoint as the cloudservices SA, yielding execution as that SA. Uses CanModifyConfiguration path (typeProviders.create emits CanModifyConfiguration on the Deployment).

A principal with deploymentmanager.deployments.update replaces an existing deployment's config; DM re-executes as the cloudservices SA.

Every Deployment Manager deployment runs as the Google APIs service agent (PROJECT_NUMBER@cloudservices.gserviceaccount.com), which by default holds roles/editor at the project.

The Google APIs service agent's effective permissions include resourcemanager.projects.setIamPolicy ONLY when it holds roles/owner. A DM config can instruct the SA to call setIamPolicy at project scope, granting the deployer project-level roles.

The Google APIs service agent's effective permissions include *.setIamPolicy on resources it manages when it holds roles/editor (GCS, SA, Pub/Sub, etc.). A DM config can instruct the SA to call setIamPolicy, granting the deployer any role on those resources.

deploymentmanager.typeProviders.create registers a custom type provider backed by an arbitrary HTTPS REST endpoint; when a deployment uses the type, DM calls that endpoint AS the cloudservices service agent. Modeled as CanModifyConfiguration on the Deployment (BuildWorker/Compute) because CanModifyCode.target does not admit the TypeProvider config node (GenericManagement).

Pushing/overwriting an image in a registry poisons every workload that pulls it - code control propagates from the registry to each consuming Compute/KubernetesWorkload.

A workload poisoned via a registry image push runs as its identity, so the pusher executes as that identity.