Derivation rules

A key manager self-granting crypto use gains the key's crypto capability.

Forging a signature as a key that anchors a more-privileged identity is escalation.

A key allow policy binding allUsers/allAuthenticatedUsers to a crypto role exposes it broadly.

A key manager that can setIamPolicy can self-grant and then decrypt.

A key manager that can setIamPolicy can self-grant and then sign.

A CMEK-encrypted Secret Manager secret is readable while the service agent holds useToDecrypt on the key.

cryptoKeys/keyRings.setIamPolicy lets a key manager bind itself a crypto role.

Signing as a key that anchors an identity (JWKS/JWT/code-signing) forges that identity.

Holding compute.loadBalancerAdmin-equivalent permissions (roles/compute.loadBalancerAdmin or roles/compute.networkAdmin / roles/compute.admin) grants full create/update/delete control over all Cloud Load Balancing resources: forwarding rules, target proxies, URL maps, backend services, NEGs, health checks, SSL certificates.

compute.backendServices.update allows modifying backend service configuration, including adding/removing Network Endpoint Groups (NEGs) from the backend pool and changing load-balancing configuration. An attacker can add a serverless NEG pointing to an attacker-controlled Cloud Run service to intercept a fraction of traffic. NOTE: disabling IAP (iap.enabled=false) is the canonical case covered by gcp-iap-disable-on-backend-service in iap.yaml - this rule focuses on the backend-pool mutation sub-case.

compute.backendServices.setSecurityPolicy removes or replaces the Cloud Armor security policy attached to a backend service, stripping L7 DDoS mitigation and WAF rule enforcement from all traffic reaching that backend. setSecurityPolicy is a distinct IAM permission (not subsumed by compute.backendServices.update).

A global or regional external forwarding rule with a public IP (loadBalancingScheme EXTERNAL or EXTERNAL_MANAGED) is reachable from the public internet on its configured port. IAP on backend services is an authentication layer but does not remove the internet-exposure fact.

compute.backendServices.setIamPolicy rewrites the IAP resource-level allow policy on a backend service. Granting roles/iap.httpsResourceAccessor to allUsers bypasses IAP authentication - all requests pass through without a Google identity - without setting iap.enabled=false, so monitoring / logs show IAP still "enabled" while access is open.

An internal Application Load Balancer or internal passthrough NLB (loadBalancingScheme INTERNAL or INTERNAL_MANAGED) is reachable only from within the VPC, peered VPCs, or connected on-premises networks. A compute resource with a foothold in the same VPC can reach the internal LB frontend and, through it, the backends.

compute.globalForwardingRules.setTarget (or compute.forwardingRules.setTarget for regional) changes the target proxy of an existing forwarding rule. An attacker can re-point a public IP at an attacker-controlled target proxy/backend service, intercepting all traffic for the forwarding rule's hostname without touching the original backend or changing DNS.

compute.targetHttpsProxies.setUrlMap (or compute.targetHttpProxies.setUrlMap) changes the URL map bound to an existing target proxy. An attacker can swap the URL map without touching the forwarding rule, redirecting all traffic through the target proxy to an attacker-controlled URL map and backend service. This achieves traffic hijack and IAP bypass without requiring setTarget on the forwarding rule.

compute.urlMaps.update (global URL maps) and compute.regionUrlMaps.update (regional URL maps) rewrite host rules, path matchers, and default service. An attacker can redirect specific paths or entire hostnames to attacker-controlled backend services, intercept decrypted application traffic, or route paths to a backend service NOT protected by IAP (bypassing authentication on those paths while leaving IAP visually enabled on the URL map).

Modify the project, folder, or org IAM policy's auditConfigs to remove DATA_READ/DATA_WRITE log types, suppressing Data Access audit log generation for targeted GCP services at the IAM policy level.

Delete or disable the _Default log sink, silencing all non-Required audit log delivery for the project - the headline defense-evasion primitive for GCP Cloud Logging.

Delete a custom or _Default log bucket (logging.buckets.delete), permanently destroying all retained log history stored in it.

Create or update a log exclusion filter to drop matching log entries before they are stored - granular evasion for specific resource types, methods, or caller identities, while leaving the sink apparently active.

Possession of the Redis AUTH string (retrieved via redis.instances.getAuthString) combined with in-VPC network reach to the Redis port grants full data-plane read access to all keys on the Memorystore instance.

Possession of the Redis AUTH string combined with in-VPC network reach grants full data-plane write access (SET, DEL, FLUSHALL, etc.), enabling cache poisoning and supply-chain injection attacks against dependent applications.

redis.instances.getAuthString retrieves the Redis AUTH string (UUID), which is the shared credential granting full Redis data-plane access to any in-VPC client that possesses it. This is the Memorystore "master key" credential grab.

When AUTH is disabled (the GCP default), any in-VPC client (Identity, Compute, Container, KubernetesWorkload) with network reachability to port 6379/6380 gains full unauthenticated Redis data-plane read access. No credential retrieval is needed.

When AUTH is disabled (the GCP default), any in-VPC client (Identity, Compute, Container, KubernetesWorkload) with network reachability to port 6379/6380 gains full unauthenticated Redis data-plane write access (SET, DEL, FLUSHALL, CONFIG), enabling cache poisoning and supply-chain injection attacks.

Principal can delete or modify Cloud Monitoring notification channels (monitoring.notificationChannels.delete / monitoring.notificationChannels.update), ensuring that even when an alert policy fires its notifications are not delivered - a defense-evasion primitive that does not grant resource access.

Principal can disable or delete Cloud Monitoring alert policies (monitoring.alertPolicies.update / monitoring.alertPolicies.delete), preventing alerting rules from firing on anomalies - a defense-evasion primitive that does not grant access to any resource.

A principal with effective networkconnectivity.hubs.update on a hub can disable the spoke acceptance gate by setting requireAcceptance=false. This eliminates the approval gate, auto-accepting all PENDING_REVIEW spokes (including attacker-controlled ones) immediately and placing them on the routing fabric without manual review.

A principal with effective networkconnectivity.spokes.create on a hub that does not require manual spoke acceptance (requireAcceptance=false) can attach an attacker-controlled VPC, VPN, or Interconnect to the hub's routing domain. The spoke becomes ACTIVE immediately, placing the attacker's network on the same routing fabric as all legitimate spoke- attached networks - a transit pivot without modifying any VPC firewall rule in the destination projects.

A principal with effective networkconnectivity.spokes.update on the hub project can accept PENDING_REVIEW spokes that are awaiting hub approval. If an attacker has created a pending spoke attaching their VPC to the hub, a compromised hub-project identity can immediately accept it, placing the attacker's network on the routing fabric without requiring hub owner approval.

orgpolicy.policy.set over ANY enforced OrganizationPolicy that blocks a modeled edge = guardrail-removal capability over it.