GCP IAM primitive roles are in use misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_49
Category - Subcategory	IAM - Overly Permissive
Provider	GCP
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	c33b4710-0874-4a42-a7bc-63884c67b859

Impact

The IAM role is an identity with specific permissions. An IAM role is similar to an IAM user: it has a Google identity with permission policies that determine what the identity can and cannot do in Google Cloud. Certain IAM roles contain permissions that enable a user with the role to impersonate or manage service accounts in a GCP project through IAM inheritance from a higher resource, i.e., project binding.

We recommend you do not set IAM role bindings with known dangerous roles that enable impersonation at the project level. The following roles enable identities to impersonate all service account identities within a project if the identity is granted the role at the project, folder, or organization level.

The following list includes our current recommendations for dangerous roles, however, it is not exhaustive as permissions and roles change frequently.

Primitive Roles:

• roles/owner
• roles/editor

Predefined Roles:

• roles/iam.securityAdmin
• roles/iam.serviceAccountAdmin
• roles/iam.serviceAccountKeyAdmin
• roles/iam.serviceAccountUser
• roles/iam.serviceAccountTokenCreator
• roles/iam.workloadIdentityUser
• roles/dataproc.editor
• roles/dataproc.admin
• roles/dataflow.developer
• roles/resourcemanager.folderAdmin
• roles/resourcemanager.folderIamAdmin
• roles/resourcemanager.projectIamAdmin
• roles/resourcemanager.organizationAdmin
• roles/cloudasset.viewer
• roles/cloudasset.owner

Service Agent Roles:

Service agent roles should not be used for any identities other than the Google managed service account they are associated with.

• roles/serverless.serviceAgent
• roles/dataproc.serviceAgent

How to Fix

Resource: google_project_iam_member google_project_iam_binding

• Arguments: role [source,go]

---

resource "google_project_iam_member" "example" { project = "project/1234567"

• role = member = "user:[e-mail]" }

---

resource "google_project_iam_binding" "example" { project = "project/1234567"

• role = members = [ "user:[e-mail]", ] }

---