Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
compute.firewallPolicies.update on a hierarchical/network policy lets an attacker insert ALLOW rules affecting all projects in the policy scope.
compute.firewalls.update lets an attacker widen an existing rule to 0.0.0.0/0 source or add new ports.
actAs + compute.instances.create -> launch instance as the SA, read metadata token.
actAs + compute.instanceTemplates.create + MIG create/setInstanceTemplate -> MIG launches instances as the SA, read metadata token.
Any code-exec/rebind/create primitive on a SA-bearing instance -> execute as its SA.
Instance runs as the SA in its serviceAccounts[] config.
Create a poisoned image/machine-image that future instances/templates boot from (supply chain).
startup-script / custom metadata frequently embeds secrets, readable via instances.get.
Metadata server vends the attached SA's OAuth token to on-host code.
Any principal with code exec on the instance can read the metadata token.
Snapshot a disk and reuse it from another project.
SSH-key metadata (instance or project) yields interactive command exec.
Create a new function bound to a passable SA (create + actAs).
A principal in project A controls code/config of a function in project B whose runtime SA has power in B.
Function env vars / mounted Secret Manager bindings carry connection strings / API keys.
CanExecuteAs a runtime SA of strictly greater privilege.
Modify function source + (invoke/call OR existing trigger) + ExecutesAs.
Update the runtime SA of an existing function to a more-privileged actAs-able SA.
Config change (env/secret/entry point) that injects code + run + ExecutesAs.
Code running in the function reads the runtime SA token from the metadata server.
2nd-gen invoke: run.routes.invoke / roles/run.invoker on the backing Cloud Run service invokes the function.
2nd-gen public invoke is governed by roles/run.invoker on the BACKING Cloud Run service's IAM policy, not the function resource.
Attacker with execution in the function can mint the runtime SA token.
cloudfunctions.functions.sourceCodeGet returns the deployed source archive, which may embed hardcoded credentials.
A function with a VPC connector can reach private resources; code running in it moves laterally into the VPC.
GCR artifacts bucket grants storage.objects.create to a principal from another project - cross-project supply-chain trust allows external actors to inject images into this project's registry.
storage.buckets.setIamPolicy on the GCR artifacts bucket = rewrite the registry IAM policy, enabling cross-project push grants, public pull, or access revocation.
artifacts bucket ACL grants allUsers storage.objects.get - GCR registry is publicly pullable without authentication, exposing embedded secrets and proprietary code.
storage.objects.create on the GCR artifacts bucket = push/overwrite a container image - code control over the registry and supply-chain poisoning of every consumer that pulls a mutable tag.
GCR push event fires to the default gcr Pub/Sub topic, triggering any Cloud Build subscription - indirect trigger of build jobs running as the Cloud Build SA.
storage.objects.get on the GCR artifacts bucket = pull container image layers for inspection (embedded credential exfil / code recon) without push capability.
A bucket IAM binding granting any read role to allAuthenticatedUsers makes the bucket readable by any Google-authenticated user worldwide (not limited to the organization) - broad tenant-wide exposure including external Google accounts.
storage.buckets.update allows a principal to modify bucket configuration: UBLA settings, CMEK default key, versioning, Pub/Sub notification configs, retention policy, and logging - enabling encryption ransomware, trigger hijacking, and configuration-based escalation.