Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
A principal that can set the repo IAM policy can self-grant roles/source.writer and then push commits - policy manipulation yields the same CanModifyCode as a direct writer binding.
source.repos.updateProjectConfig controls project-wide CSR settings, including whether Cloud Build automatic triggers fire - a meta-gate on CSR-triggered CI/CD paths in the project.
A principal with source.repos.update can push commits to the CSR repository, including a modified cloudbuild.yaml - the code-supply-chain write primitive that arms any Cloud Build push trigger watching the target branch.
source.repos.get (clone/read) grants read access to the full repository content, including any secrets committed to history and build-spec files that reveal SA references and deployment targets.
source.repos.updateRepoConfig can relax branch-protection rules or change push configurations, potentially upgrading a CONDITIONAL CanModifyCode (gated by branch protection) to ACTIVE.
source.repos.setIamPolicy grants full control over the repository's IAM allow policy - self-grant roles/source.writer, then push to arm Cloud Build triggers.
A CSR repo IAM binding for a WIF principalSet/principal with source.repos.update grants an external OIDC identity (e.g. GitHub Actions) direct push access without any long-lived GCP key - supply-chain injection from external CI.
cloudtasks.tasks.create enqueues a task with an attacker-controlled body to a Cloud Tasks queue - the publish/send primitive that messaging-chains uses to derive CanTrigger(principal → consumer).
A Cloud Tasks queue IAM policy granting cloudtasks.tasks.create to a principal from another GCP project is cross-project messaging trust - the foreign principal can publish tasks to trigger the queue's consumer in the queue's project.
Re-pointing the queue's OIDC/OAuth token SA (cloudtasks.queues.update + iam.serviceAccounts.actAs) causes every future dispatch to carry a token for the chosen SA - an attacker controlling the consumer endpoint captures the token and exercises the SA's privileges.
cloudtasks.tasks.run immediately force-dispatches an existing task to its configured consumer, bypassing schedule time and rate limits - a direct CanTrigger primitive that requires a suitable task to already exist in the queue.
cloudtasks.tasks.create with a per-task httpRequest.oidcToken.serviceAccountEmail (or oauthToken) requires iam.serviceAccounts.actAs on the chosen SA - the per-task identity override path.
cloudtasks.queues.update + iam.serviceAccounts.actAs on a SA allows an attacker to configure that SA as the queue-level OIDC/OAuth token identity - the GCP actAs guard rail for Cloud Tasks queue-SA attachment.
A Cloud Tasks queue with httpTarget.uri (or an App Engine target) dispatches tasks to its configured consumer HTTP endpoint - the event-source binding fact consumed by messaging-chains rule 1.
A Cloud Tasks HTTP target queue configured with httpTarget.oidcToken.serviceAccountEmail (or oauthToken) attaches a minted token for that SA to every dispatched request, exposing the SA's credential to the consumer endpoint.
cloudtasks.tasks.list + cloudtasks.tasks.fullView allow a principal to read full task bodies in a Cloud Tasks queue - the data-plane read primitive that feeds credential-chains when tasks carry credentials.
cloudtasks.queues.setIamPolicy lets an attacker grant itself cloudtasks.tasks.create (task enqueue) or cloudtasks.queues.update (queue config change) on the queue, completing either the trigger-escalation or the SA-swap path.
A Cloud Tasks task body (httpRequest.body, base64-encoded) contains credential material (API keys, passwords, SA key JSON, connection strings) readable by any principal with cloudtasks.tasks.fullView on the queue.
cloudtasks.queues.update lets an attacker change the queue's httpTarget.uriOverride (redirect all dispatches to an attacker endpoint), httpTarget.oidcToken.serviceAccountEmail (with actAs - swap the token SA), headerOverrides, App Engine routing, or rate limits.
Setting httpTarget.uriOverride to an attacker-controlled endpoint (via cloudtasks.queues.update, no actAs needed) redirects all future dispatches there - delivering the queue's OIDC/OAuth SA token and task body payloads to the attacker.
Create a Workbench notebook instance whose underlying GCE VM runs as a passable SA. The instance persists; accessing JupyterLab (notebooks.instances.use) executes code as the SA.
Create a Vertex AI custom training job / pipeline job / notebook execution job whose workers run as a passable SA (create + actAs). Job runs immediately on creation - no invoke step.
A principal in project A can execute code as a SA that holds privilege in project B by submitting a training job or creating a notebook bound to that cross-project SA.
A training job, pipeline job, or notebook execution job binds a cross-project service account.
Workbench notebook instance explicitly declares its service account.
Training job, pipeline job, or notebook execution job explicitly declares its service account.
A Workbench notebook instance binds a cross-project service account.
Principal can modify Workbench instance startup or post-startup script via notebooks.instances.update.
Principal holds notebooks.instances.update or notebooks.instances.updateConfig on a Workbench instance.
Principal holds notebooks.instances.setIamPolicy on a Workbench instance (explicit permission normalization).
Principal holds notebooks.instances.use on a Workbench instance (explicit permission normalization).
Principal holds iam.serviceAccounts.actAs on a service account (explicit permission normalization).
Principal holds aiplatform.schedules.create to create recurring schedule triggers (explicit permission normalization).
A training job or Workbench notebook exposes its runtime SA credentials to any code it runs via the GCE metadata server.
Update a Workbench instance's service account (notebooks.instances.update + actAs on new SA) so future code runs as the new SA.
A forwarding rule with loadBalancingScheme EXTERNAL and an assigned external IP exposes the backend service to the public internet.
An ingress firewall rule allowing 0.0.0.0/0 (or ::/0) on a specific port permits any internet host to initiate a connection to matching VMs on that port.
A Private Service Connect consumer endpoint (forwarding rule targeting a serviceAttachment) provides a private internal-IP path from the consumer VPC to the producer service, without internet traversal.
A service-project service account holding compute.networkUser on a host-project subnet can create workloads whose NICs land in that subnet, giving those workloads internal-IP reachability to all other resources in the subnet (including those from other service projects).
setIamPolicy on a ServiceAccount lets a principal add/loosen the workloadIdentityUser binding that maps an external WIF subject to the SA.
Federating into a WIF-impersonated ServiceAccount gives the external principal a foothold in the SA's home project.
An external identity the WIF provider accepts and a workloadIdentityUser binding resolves can federate into the impersonated ServiceAccount.
Creating or updating a WIF pool provider lets a principal add/loosen the trust to an attacker-controlled external IdP.
Update the serviceAccount field to swap the runtime SA of an existing workflow.