Derivation rules

dataproc.clusters.update allows changing the cluster's service account (and other runtime config), which with actAs on the new SA swaps the cluster's execution identity.

Create a new Dataproc cluster whose VMs run as a chosen SA (clusters.create + actAs); submit a job to execute code as that SA.

A Dataproc cluster whose service account belongs to a different project creates a cross-project trust; code in jobs runs as a SA from another project.

A Dataproc cluster exposes its service account's OAuth token to any code running in submitted jobs via the GCE metadata server.

dataproc.clusters.update on initializationActions (or the GCS path they reference) injects code that executes as the cluster SA on the next node join or cluster restart.

dataproc.jobs.create on an existing cluster lets the principal submit arbitrary Spark/PySpark/Hive code that runs on cluster VMs -> RCE as the cluster SA.

Dataproc cluster master VM with a public IP and permissive dataproc-* firewall rules exposes the YARN UI / Spark History Server to the internet.

dataproc.workflowTemplates.instantiate directly runs the workflow template, feeding cicd-chains trigger-then-executes-as.

dataproc.workflowTemplates.update lets the principal modify the job DAG (steps, jars, main class) a workflow template runs as the cluster SA.

Datastream ConnectionProfile resources store source DB credentials (username/password or SSH private key). An attacker with write access (connectionProfiles.create/update) can harvest credentials by redirecting a test connection to a controlled host; secretManagerStoredPassword references expose Secret Manager paths.

datastream.privateConnections.create lets a principal establish a VPC peering from the Datastream service network to an attacker-controlled VPC or a sensitive customer network, enabling network reach for probing or bridging boundaries.

A Datastream PrivateConnection establishes VPC peering between the Datastream service network and a customer VPC, enabling network reach to private resources within that VPC and resources accessible via Cloud VPN or Dedicated Interconnect.

datastream.streams.create + datastream.connectionProfiles.create lets a principal create a new CDC stream from an existing source database to an attacker-controlled destination, exfiltrating source data.

datastream.streams.update lets a principal redirect the stream's destination (BigQuery dataset or GCS path) to an attacker-controlled sink, exfiltrating all CDC data from the source database.

Re-pointing a target's executionConfigs SA (targets.update + actAs) then promoting a rollout yields code execution as the newly attached SA.

clouddeploy.automations.create with a promoteReleaseRule or advanceRolloutRule schedules automatic rollout creation, effectively giving CanTrigger over the deploy Cloud Build worker.

A Cloud Deploy target's execution SA from a different project establishes a cross-project trust enabling CanEnterProject on that SA's home project.

The Cloud Deploy execution SA's Cloud Run deployment permissions (run.developer) give it CanDeploy to a Cloud Run service.

The Cloud Deploy execution SA's GKE deployment permissions (container.developer) give it CanDeploy to a GKE cluster.

Cloud Deploy job run worker (Cloud Build) executes as the target's configured execution service account.

Write access to the Cloud Deploy pipeline's GCS source bucket allows injecting malicious skaffold.yaml into every render job.

clouddeploy.deliveryPipelines.setIamPolicy lets the principal modify the pipeline's IAM policy, granting itself releases.create / rollouts.create.

clouddeploy.deployPolicies.override bypasses a Cloud Deploy time-window restriction, enabling rollouts during governance freeze windows.

Create a Cloud Deploy release with attacker-controlled Skaffold config + actAs(render SA) → execute arbitrary code as the render SA inside the Cloud Build worker.

clouddeploy.releases.create with actAs on the render SA injects attacker-controlled Skaffold config/hooks into the render Cloud Build worker.

clouddeploy.rollouts.approve unblocks a NEEDS_APPROVAL rollout, triggering the deploy Cloud Build worker (no actAs required).

clouddeploy.rollouts.create (promotion) with actAs on the deploy SA triggers the deploy Cloud Build worker running as the deploy SA.

Promote a Cloud Deploy release (rollouts.create) + actAs(deploy SA) → deploy Cloud Build worker executes as the deploy SA, which has runtime control over the target (GKE/Cloud Run).

clouddeploy.targets.update + actAs(execution SA) re-points all future Cloud Deploy job runs on this target to execute as the chosen SA.

roles/deploymentmanager.admin grants full control of all DM resources - create, update, delete, and setIamPolicy on DM deployment objects.

deploymentmanager.deployments.stop / cancelPreview allows aborting or modifying deployment state without full resource creation.

deploymentmanager.deployments.create allows submitting a new deployment config; DM executes it as the cloudservices service agent. This is the CI/CD CanModifyCode primitive for DM.

deploymentmanager.deployments.update allows replacing an existing deployment's config; DM re-executes as the cloudservices SA, enabling injection into an already-provisioned deployment.

A principal with deploymentmanager.deployments.create submits an attacker-controlled config; DM actuates it as the Google APIs service agent, executing code (resource creation, setIamPolicy) as that SA's identity.

A principal with deploymentmanager.typeProviders.create registers a custom type provider backed by an attacker-controlled endpoint; a DM deployment using that type causes DM to call the endpoint as the cloudservices SA, yielding execution as that SA. Uses CanModifyConfiguration path (typeProviders.create emits CanModifyConfiguration on the Deployment).

A principal with deploymentmanager.deployments.update replaces an existing deployment's config; DM re-executes as the cloudservices SA.

Every Deployment Manager deployment runs as the Google APIs service agent (PROJECT_NUMBER@cloudservices.gserviceaccount.com), which by default holds roles/editor at the project.

The Google APIs service agent's effective permissions include resourcemanager.projects.setIamPolicy ONLY when it holds roles/owner. A DM config can instruct the SA to call setIamPolicy at project scope, granting the deployer project-level roles.

The Google APIs service agent's effective permissions include *.setIamPolicy on resources it manages when it holds roles/editor (GCS, SA, Pub/Sub, etc.). A DM config can instruct the SA to call setIamPolicy, granting the deployer any role on those resources.

deploymentmanager.typeProviders.create registers a custom type provider backed by an arbitrary HTTPS REST endpoint; when a deployment uses the type, DM calls that endpoint AS the cloudservices service agent. Modeled as CanModifyConfiguration on the Deployment (BuildWorker/Compute) because CanModifyCode.target does not admit the TypeProvider config node (GenericManagement).

An IAM binding on an Eventarc Advanced message bus granting eventarc.messageBuses.publish to a principal in a different project is cross-project event-injection trust - that external principal can drive all pipelines bound to the bus.

eventarc.triggers.create lets an attacker bind any reachable event source to any destination consumer as an Eventarc trigger - the event-source-binding creation primitive (Phase-10 CanSchedule).

An IAM binding on an Eventarc trigger granting eventarc.triggers.update (or .create in the project) to a principal in a different project is cross-project trigger-management trust - that external principal can redirect the trigger or bind new sources to consumers in this project.

CanExecuteAs on a consumer's runtime SA of strictly greater privilege than the attacker, reached via an Eventarc trigger, is privilege escalation.

Create a new Eventarc trigger binding an event source to a destination consumer, then publish an event (or wait for a natural event) to run the consumer as its runtime SA. Provides the Eventarc-specific framing of messaging-chains rule 2.

Update an existing Eventarc trigger's destination to point at attacker-controlled or higher-privilege compute, then wait for a natural event to fire, gaining execution as the new destination's runtime SA.

An Eventarc Advanced message bus has an IAM allow policy governing who may publish to it.

An IAM binding on an Eventarc Advanced message bus granting publish rights to a principal in a different project.

An IAM binding on an Eventarc trigger granting trigger management permissions to a principal in a different project.

An Eventarc trigger uses its serviceAccount field as the delivery identity when calling the destination endpoint.