Roles impersonate or manage Service Accounts used at folder level misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_44
Category - Subcategory	IAM - Overly Permissive
Provider	GCP
Severity	HIGH
Framework	Terraform, Terraform Plan

Impact

The IAM role is an identity with specific permissions. An IAM role is similar to an IAM user: it has a Google identity with permission policies that determine what the identity can and cannot do in Google Cloud. Certain IAM roles contain permissions that enable a user with the role to impersonate or manage service accounts in a GCP folder through IAM inheritance from a higher resource, i.e., folder binding.

We recommend you do not set IAM role bindings with known dangerous roles that enable impersonation at the folder level.

The following roles enable identities to impersonate all service account identities within a project if the identity is granted the role at the project, folder, or organization level.

The following list includes our current recommendations for dangerous roles, however, it is not exhaustive as permissions and roles change frequently.

Primitive Roles:

• roles/owner
• roles/editor

Predefined Roles and Service Agent Roles:

Service agent roles should not be used for any identities other than the Google managed service account they are associated with.

• roles/iam.serviceAccountUser
• roles/iam.serviceAccountTokenCreator
• roles/iam.serviceAccountKeyAdmin
• roles/iam.serviceAccountAdmin
• roles/iam.workloadIdentityUser
• roles/deploymentmanager.editor
• roles/cloudbuild.builds.editor
• roles/aiplatform.customCodeServiceAgent
• roles/aiplatform.extensionServiceAgent
• roles/aiplatform.serviceAgent
• roles/apigateway.serviceAgent
• roles/apigee.serviceAgent
• roles/appengine.serviceAgent
• roles/appengineflex.serviceAgent
• roles/bigquerycontinuousquery.serviceAgent
• roles/bigquerydatatransfer.serviceAgent
• roles/bigqueryspark.serviceAgent
• roles/cloudbuild.serviceAgent
• roles/cloudconfig.serviceAgent
• roles/clouddeploy.serviceAgent
• roles/cloudfunctions.serviceAgent
• roles/cloudscheduler.serviceAgent
• roles/cloudtasks.serviceAgent
• roles/composer.serviceAgent
• roles/compute.serviceAgent
• roles/connectors.serviceAgent
• roles/dataflow.serviceAgent
• roles/dataproc.serviceAgent
• roles/eventarc.serviceAgent
• roles/integrations.serviceAgent
• roles/ml.serviceAgent
• roles/notebooks.serviceAgent
• roles/pubsub.serviceAgent
• roles/run.serviceAgent
• roles/serverless.serviceAgent
• roles/sourcerepo.serviceAgent
• roles/workflows.serviceAgent
• roles/iam.serviceAccountOpenIdTokenCreator
• roles/aiplatform.colabServiceAgent
• roles/backupdr.computeEngineOperator
• roles/backupdr.serviceAgent
• roles/batch.serviceAgent
• roles/clouddeploymentmanager.serviceAgent
• roles/cloudtpu.serviceAgent
• roles/compute.instanceGroupManagerServiceAgent
• roles/configdelivery.serviceAgent
• roles/container.serviceAgent
• roles/datapipelines.serviceAgent
• roles/dataplex.serviceAgent
• roles/dataprep.serviceAgent
• roles/dataproc.hubAgent
• roles/firebaseapphosting.serviceAgent
• roles/firebasemods.serviceAgent
• roles/gameservices.serviceAgent
• roles/genomics.serviceAgent
• roles/krmapihosting.anthosApiEndpointServiceAgent
• roles/krmapihosting.serviceAgent
• roles/lifesciences.serviceAgent
• roles/osconfig.serviceAgent
• roles/runapps.serviceAgent
• roles/securitycenter.securityResponseServiceAgent
• roles/workstations.serviceAgent
• roles/securesourcemanager.serviceAgent
• roles/assuredoss.admin
• roles/securitycenter.admin
• roles/vpcaccess.serviceAgent
• roles/cloudbuild.builds.builder
• roles/composer.worker
• roles/dataflow.admin
• roles/dataflow.developer
• roles/run.sourceDeveloper

How to Fix

Resource: google_folder_iam_member google_folder_iam_binding

• Arguments: role [source,go]

---

resource "google_folder_iam_member" "example" { folder = "folders/1234567"

• role = member = "user:[e-mail]" }

---

resource "google_folder_iam_binding" "example" { folder = "folders/1234567"

• role = members = [ "user:[e-mail]", ] }

---