Derivation rules

bigtable.authorizedViews.mutateRows grants write access to a scoped subset of a table (row key prefix / column qualifier filtering). The caller can only write rows within the authorized view's defined scope; write access to the parent table is NOT granted. CanWriteData is scoped to the AuthorizedView node.

bigtable.tables.mutateRows grants the caller the ability to write, update, and delete rows in a Bigtable table. This is included in roles/bigtable.user and above. Data mutation enables credential injection, configuration poisoning, and application state corruption.

bigtable.tables.mutateRows on a CMEK-encrypted cluster; the Bigtable service agent decrypts via Cloud KMS before allowing writes - CanWriteData is CONDITIONAL(key_permission) on the service agent's KMS grant.

privateca.certificates.create + caPools.use lets a principal issue a cert signed by the CA private key.

A cert signed by the CA authenticates as the subject/SAN it names to a consuming trust.

A cross-project requester forging a cert a privileged consumer in the CA's project trusts enters that project.

Forging a cert that impersonates a strictly more-privileged identity is escalation.

Issue a cert for an attacker-chosen subject/SAN that a downstream trust accepts, impersonating that identity.

caPools.update rewrites the issuance policy / identity constraints, enabling arbitrary-subject forgery.

A CA-pool binding granting requester/use to allUsers/allAuthenticatedUsers exposes issuance broadly.

caPools.setIamPolicy writes the pool's IAM allow policy (grant self/others any access).

caPools.setIamPolicy lets a caller bind itself certificateRequester and then issue.

Issue from a KMS-backed CA; the signature is performed by the CAS service agent, not the caller.

A principal that can execute as a workload SA holding certificateRequester can issue certs.

Workspace super-admin can authorize any service account for Domain-Wide Delegation (adding its OAuth2 client ID to the delegated clients list with chosen scopes), creating a new tenant-wide impersonation primitive.

Workspace delegated admin (or super-admin) with the USER_MANAGEMENT / password-reset privilege can reset any non-admin user's password, hijacking their account.

A DWD SA with both admin-directory and cloud-platform scopes can act as a super-admin and thereby obtain GCP Organization-level control.

Service account with Domain-Wide Delegation can act as any active Workspace user in the domain for its configured OAuth2 scopes, without the user's knowledge or consent - a tenant-wide identity takeover primitive.

Principal with cloudidentity.groups.memberships.create (or group Manager/Owner role) can add any principal - including itself - to the target group, inheriting its bound GCP IAM roles.

Principal with cloudidentity.groups.memberships.delete (or group Manager/Owner) can remove members from the target group, enabling member deprovisioning or audit-trail destruction.

Workspace super-admin can grant any GCP IAM role to any principal in the linked GCP organization, equivalent to resourcemanager.organizations.setIamPolicy.

compute.securityPolicies.update lets a principal modify rules in a Cloud Armor security policy - deleting DENY rules, removing geo/IP blocks, disabling adaptive protection, or inserting a catch-all ALLOW - weakening the WAF/DDoS edge access control protecting the attached HTTP(S) LB backend.

Search, list, or export all GCP assets and IAM policy bindings at org/folder/project scope via Cloud Asset Inventory - the same enumeration the reference collector performs, giving an attacker a pre-built map of the environment.

Delete or modify a Cloud Asset Inventory asset feed, disrupting continuous inventory delivery to the reference collector's Pub/Sub topic - a cover-tracks evasion primitive that creates a detection blind spot.

cloudbuild.builds.create gives the principal full control of build steps executed as the legacy Cloud Build service account, with no actAs requirement.

cloudbuild.builds.create + iam.serviceAccounts.actAs on a user SA: submit arbitrary build steps as that SA.

A Cloud Build trigger's builds execute as the configured service account (or the legacy SA if none is set).

All Cloud Build steps can mint OAuth tokens for the build SA from the GCE metadata server; code execution in any step yields the build SA's credentials.

A Cloud Build private worker pool peered into a VPC gives build steps network access to private resources in that VPC.

A principal with pubsub.topics.publish on a trigger's configured Pub/Sub topic can fire that trigger, potentially executing code as the trigger's SA.

cloudbuild.connections.setIamPolicy lets the principal grant or revoke access to a Cloud Build repository connection, potentially enabling unauthorized source token access.

cloudbuild.triggers.create + iam.serviceAccounts.actAs: create a new trigger whose builds execute attacker-controlled steps as a chosen SA.

cloudbuild.triggers.run lets the principal fire an existing trigger at a chosen source revision; code execution as the trigger's SA is CONDITIONAL on the current definition being attacker-influenced.

cloudbuild.triggers.update lets the principal replace a trigger's build definition (inline steps, cloudbuild.yaml path, or substitutions); the next trigger fire executes the attacker-controlled definition as the trigger's SA.

cloudbuild.workerpools.update lets the principal change a private worker pool's VPC peering configuration, redirecting future builds' network access.

A CNAME (or ALIAS) resource record set in a public Cloud DNS zone whose target resolves to a GCP-managed FQDN suffix that no longer has a backing resource in collected GCP inventory enables subdomain takeover: an external attacker can claim that resource name and inherit DNS resolution for the dangling hostname.

A principal holding dns.changes.create (or an equivalent role such as roles/dns.admin, roles/editor, or roles/owner) at the GCP project scope can submit DNS changesets to any public managed zone in that project, overwriting any resource record set - enabling hostname redirect, DNS-01 TLS certificate acquisition, MX record manipulation, and OAuth redirect URI abuse.