Derivation rules

Delete/alter a custom org-policy constraint that enforces a security invariant, unblocking what it suppressed.

Remove iam.automaticIamGrantsForDefaultServiceAccounts to re-enable over-privileged default SAs on new resources.

Weaken iam.allowedPolicyMemberDomains to allow granting roles to external identities.

Remove storage.publicAccessPrevention to allow making Cloud Storage buckets public.

Remove/weaken iam.disableServiceAccountKeyCreation to re-enable SA key creation.

Remove iam.disableServiceAccountKeyUpload to allow binding an attacker keypair to an SA.

Remove sql.restrictPublicIp to allow Cloud SQL instances to get a public IP.

Weaken compute.vmExternalIpAccess to allow assigning public IPs to VMs (internet exposure).

Create a snapshot of a disk and grant a cross-project principal access to it, enabling the attacker to restore it as a disk in their own project and read all on-disk data (secrets, credentials, database files).

A snapshot with allAuthenticatedUsers or allUsers in its IAM policy is exposed to all GCP identities (authenticated or nominally public) across all projects/organizations.

A principal with compute.snapshots.setIamPolicy can grant themselves or a cross-project principal access to the snapshot, enabling data exfiltration or unauthorized cross-project reads.

A principal with compute.snapshots.useReadOnly on a shared snapshot and compute.disks.create can restore it as a disk and read all on-disk data across project boundaries.

A principal within the same project with compute.snapshots.useReadOnly and compute.disks.create can restore any project snapshot as a disk and read all on-disk data, escalating access to disks they don't directly have read permissions on.

An identity with compute.forwardingRules.create and compute.subnetworks.use on the target subnet can create a new PSC consumer forwarding rule pointing at any Service Attachment the consumer project is authorized to connect to. This opens a new private channel to the producer service that did not previously exist. compute.addresses.create is only required when reserving a static IP; PSC endpoints with ephemeral IPs do not require it.

An identity with compute.serviceAttachments.create can publish a new Internal Load Balancer backend as a Private Service Connect service attachment, making it reachable by any PSC consumer that has the Service Attachment URI and can create a forwarding rule. This is a high-value capability for lateral movement or service hijacking attacks: the attacker can intercept traffic intended for a legitimate service or exfiltrate data through a honeypot endpoint. The published service is visible to all projects in ACCEPT_AUTOMATIC mode (default) or to explicitly listed projects in ACCEPT_MANUAL mode.

An identity with compute.forwardingRules.delete on a PSC consumer endpoint (forwarding rule with purpose=PRIVATE_SERVICE_CONNECT) can remove it. This is a destructive capability that disrupts private connectivity to the producer service, purely an availability impact rather than privilege escalation or data access.

An identity with compute.serviceAttachments.update can modify the consumerAcceptLists of a Service Attachment (or change connectionPreference to ACCEPT_AUTOMATIC), adding unauthorized consumer projects and granting them private access to the producer's Internal LB backend.

A PSC consumer forwarding rule targeting the all-apis or vpc-sc Google API bundle gives workloads in the consumer VPC private IP access to Google APIs (Cloud Storage, Secret Manager, BigQuery, etc.) without a public IP or internet egress. An in-network attacker with code running on a consumer-VPC workload can call any Google API the workload's SA is permitted to call over this private path.

A PSC consumer forwarding rule targeting a Service Attachment (producer-published service) gives workloads in the consumer VPC private IP access to the producer's Internal Load Balancer backend (Cloud SQL, Cloud Run, GCE-based service, etc.). An in-network attacker can reach the producer backend over this private channel without traversing the public internet.

pubsub.subscriptions.create (or pubsub.subscriptions.update) + iam.serviceAccounts.actAs on a push SA allows creating a push subscription that delivers the SA's OIDC token to a push endpoint, attaching the SA's identity to the event source.

A Pub/Sub subscription IAM binding granting pubsub.subscriptions.consume to a principal from another GCP project enables the external principal to read/drain the subscription (data exfiltration via messaging-chains).

A Pub/Sub topic IAM binding granting pubsub.topics.publish to a principal from another GCP project is cross-project publish trust; feeds can-control's CanEnterProject derivation via messaging-chains.

pubsub.topics.publish on a topic is the data-plane publish action; the principal can send attacker-influenced messages that drive push-subscription consumers. Consumed by messaging-chains as CanWriteData(principal → topic).

A Pub/Sub push subscription delivers a Google-signed OIDC token for its pushConfig.oidcToken.serviceAccountEmail to the push endpoint on every delivery; code at the endpoint can extract and replay the token, exposing the push SA's identity.

An active push subscription binding its topic's messages to an HTTP endpoint (Cloud Run service / Cloud Function URL) makes the subscription an event-source bridge: messages published to the topic are delivered to the consumer. Consumed by messaging-chains to derive CanTrigger(publisher → consumer).

pubsub.subscriptions.setIamPolicy allows rewriting the subscription IAM policy, enabling self-grant of pubsub.subscriptions.consume for credential/secret extraction via credential-chains.

pubsub.topics.setIamPolicy allows rewriting the topic IAM policy, enabling self-grant of pubsub.topics.publish and the downstream trigger chain.

pubsub.subscriptions.consume on a subscription is the data-plane pull action; if the subscription carries credential material, credential-chains derives CanImpersonate. Also an exfiltration path when cross-project.

allUsers or allAuthenticatedUsers granted pubsub.topics.publish on a topic makes it publicly writable; any internet caller can trigger bound push-subscription consumers via messaging-chains without project credentials.

pubsub.subscriptions.update allows changing the push endpoint URL and push SA (oidcToken.serviceAccountEmail) on a subscription, enabling push-endpoint redirect for data exfiltration or push SA swap for credential exposure.

Create a new Cloud Run resource bound to a chosen SA (actAs) and invoke/run it.

Modify code/config of an existing Cloud Run resource; it runs as its existing runtime SA.

Code running in a Cloud Run container mints tokens for the runtime SA from the metadata server.

allUsers/allAuthenticatedUsers bound to run.invoker on a service reachable from the internet.

Set/replace the runtime SA on a Cloud Run resource (create or update) while holding actAs on that SA.

Cloud Run resource with Direct VPC egress / Serverless VPC Access connector can reach private targets.