Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
Trigger/start a runner whose current definition already runs attacker-influenced code, executing as the runner's identity.
CanExecuteAs
derived
Exec into a pod (cluster RBAC / credential / run-command) inherits the pod's mounted ServiceAccount/IRSA/Workload-Identity token, executing as that identity.
CanExecuteAs
derived
Ability to grant permissions at a boundary scope = control of that boundary.
Controls
derived
Admin over a resource = control of it.
Controls
derived
A principal whose effective permissions include key or service-account-key creation can mint new keys.
CanCreateKey
derived
A principal that can create a resource type and modify the instance can delete+recreate it to inherit its identity/trust.
CanReplace
derived
Reading a credential that is credentials for a data/messaging service endpoint lets the reader authenticate to that endpoint.
AuthenticatesTo
derived
Holding decrypt on a secret's wrapping key upgrades a key-gated (CONDITIONAL) secret read to ACTIVE.
CanReadSecret
derived
Assuming/federating into a role in another account = entering it.
Materialize a foothold identity inside a subscription/project/tenant/organization when a principal can impersonate/assume/federate into an identity homed there; escalate to Controls only when entry implies admin at a top boundary.
Executing as a service account in a different GCP project = entering that project (GCP-scoped extension of can-control.yaml escalation logic).
Executing as a strictly-more-privileged identity is escalation.
CanEscalateTo
derived
Modify code of a compute resource that runs as a privileged identity.
CanExecuteAs
derived
Run OS commands on a host that already runs as a privileged identity.
CanExecuteAs
derived
Change the execution identity binding of a compute resource to a chosen privileged identity.
CanExecuteAs
derived
Create a new workload and attach a privileged identity to it.
CanExecuteAs
derived
Any specific execution capability on a compute resource implies the generalized CanExecuteOn.
CanExecuteOn
derived
Executing as a workload identity inherits that identity's ability to read a secret.
CanReadSecret
derived
Federating in as an internal Role/ServiceAccount lets the principal act AS it, inheriting its outbound capabilities; rolled up as CanImpersonate.
CanImpersonate
derived
Federating into a Role homed in an AWS account gives the federated principal a foothold in that account.
CanEnterAccount
derived
Federating into a ServiceAccount homed in a GCP project gives the federated principal a foothold in that project.
CanEnterProject
derived
A realized external->internal identity mapping whose trust condition an attacker-controlled external identity can satisfy yields federation into the internal identity.
CanFederateAs
derived
Issuing a certificate from a CA that is the trust anchor of a federation lets the issuer mint a matching external identity and federate in.
CanFederateAs
derived
Identity that can grant policyAdmin at access policy scope gains full perimeter control.
App Engine execution-as a more-privileged SA rolls up to an escalation edge.
Deploy a version with a custom, more-privileged runtime SA via actAs.
Interactive debug/SSH on a Flexible instance yields code exec as the instance runtime SA.
Deploy a new App Engine version (attacker code) that executes as the runtime SA.
Route App Engine traffic to a version that runs as a privileged SA (no invoke perm needed).
An App Engine instance (Compute) runs as its configured (or default appspot) service account, inherited from the version's serviceAccount binding.
A serving App Engine version is reachable at its appspot.com URL (modeled as a PublicEndpoint node) unless ingress-restricted.
Code running in an App Engine instance can read the runtime SA token from the GCE metadata server.
roles/artifactregistry.admin or roles/artifactregistry.repoAdmin grants full control over an Artifact Registry repository, including push, policy mutation, and deletion.