Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
Principal with securitycenter.settings.update can disable SCC detection services at org or project scope, permanently stopping finding generation for the disabled services.
Principal holds effective securitycenter.assets.list permission (recon-only read).
Principal holds effective securitycenter.findings.setState or .setMute permission.
Principal holds effective securitycenter.muteconfigs.create or .update permission.
Principal holds effective securitycenter.notificationconfigs.delete permission to delete notification routing configs.
Principal holds effective securitycenter.notificationconfigs.update permission to modify notification routing.
Principal holds effective securitycenter.findings.list permission (recon-only read).
Principal holds effective securitycenter.settings.update permission at org or project scope.
Principal with securitycenter.muteconfigs.create or .update can create or modify a mute config that auto-suppresses matching SCC findings, silencing targeted detection signals while SCC appears operational.
Principal with securitycenter.findings.setState or findings.setMute can individually mark findings as INACTIVE or MUTED, removing them from the active queue without a rule-based mute config.
Principal with securitycenter.notificationconfigs.delete or .update can delete or modify notification configs that route SCC findings to external systems (SIEM, SOAR, ticketing), disrupting the downstream alerting pipeline.
Principal with both securitycenter.findings.list and securitycenter.assets.list can enumerate all SCC findings and the full GCP asset inventory, providing complete org-wide resource reconnaissance.
Principal with securitycenter.findings.list can enumerate all SCC findings across their scope, revealing exploitable misconfigurations.
gcp
explicit
The secret's payload authenticates as another identity / service account / data store.
A cross-project principal reading a secret whose payload is a credential privileged in the secret's project enters that project.
Reading a secret that yields credentials for a strictly more-privileged identity is escalation.
Reading a secret whose payload is an SA JSON key yields long-lived credentials for that SA.
A secret allow policy binding allUsers/allAuthenticatedUsers to secretAccessor exposes the payload broadly.
secretmanager.versions.access reads the cleartext payload of a secret.
Read a CMEK-encrypted secret; decrypt is done by the Secret Manager service agent, not the caller.
A principal that can execute as a workload SA holding versions.access can read the secret.
secrets.setIamPolicy writes the secret's IAM allow policy (grant self/others any access).
secrets.setIamPolicy lets a caller bind itself secretAccessor and then read the payload.
secretmanager.versions.add writes a new payload version that downstream consumers will read.
Creating a Spanner backup (spanner.backups.create) then setting the backup's IAM policy (spanner.backups.setIamPolicy) to grant a cross-project principal spanner.backups.restoreDatabase copies the full database contents across the project boundary - effective exfiltration.
spanner.databases.read (or spanner.databases.select) + spanner.sessions.create together constitute effective data-plane read access: the caller can open a session and execute SQL to read arbitrary rows from any table in the database.
spanner.databases.setIamPolicy lets a principal grant any role on a specific database to any principal, including itself - self-granting roles/spanner.databaseAdmin yields full data-plane access plus further IAM mutation rights on that database.
spanner.instances.setIamPolicy lets a principal grant any instance-level role to any principal, including itself. This affects ALL databases within the instance - a broader blast radius than database-scope setIamPolicy.
spanner.databases.write + spanner.sessions.create together constitute effective data-plane write access: the caller can open a session and execute DML (INSERT, UPDATE, DELETE) statements to modify arbitrary rows in any table in the database.
roles/source.admin grants full control over a CSR repository, including push, IAM policy mutation, and deletion - implies CanModifyCode, CanModifyPolicy, CanRead, and CanModifyConfiguration.
A CSR repo IAM binding that grants source.repos.update to a service account from a different GCP project establishes cross-project trust - that SA can push to this project's repository and arm Cloud Build triggers.