GCP iam.roles.update Privilege Escalation

AnalysisType: rule
RuleID: "GCP.iam.roles.update.Privilege.Escalation"
DisplayName: "GCP iam.roles.update Privilege Escalation"
Description:
  If your user is assigned a custom IAM role, then iam.roles.update will allow you to update
  the “includedPermissons” on that role. Because it is assigned to you, you will gain the additional privileges,
  which could be anything you desire.
Enabled: true
Filename: gcp_iam_roles_update_privilege_escalation.py
LogTypes:
  - GCP.AuditLog
Tags:
  - GCP
Severity: High
Reports:
  TA0004:
    - T1548
DedupPeriodMinutes: 60
Threshold: 1
Reference: https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/
Runbook:
  Confirm this was authorized and necessary behavior. This is not a vulnerability in GCP, it is a vulnerability
  in how GCP environment is configured, so it is necessary to be aware of these attack vectors and to defend against
  them. It’s also important to remember that privilege escalation does not necessarily need to pass through the
  IAM service to be effective. Make sure to follow the principle of least-privilege in your environments to help
  mitigate these security risks.
Tests:
  - Name: Test-876cde
    ExpectedResult: false
    Log:
      p_enrichment: null
      protoPayload:
        authorizationInfo:
          - granted: true
            permission: iam.roles.dunno
            resource: projects/some-research/roles/CustomRole
            resourceAttributes: {}
  - Name: Test-ffdf6
    ExpectedResult: true
    Log:
      p_enrichment: null
      protoPayload:
        authorizationInfo:
          - granted: true
            permission: iam.roles.update
            resource: projects/some-research/roles/CustomRole
            resourceAttributes: {}