OpenGraph Node Edge Tables

OpenGraph - Node/Edge Tables

Table reference for the main node and edge types emitted by GCPwn OpenGraph.

Coverage note:

• Some edge kinds are rule-driven from og_privilege_escalation_paths.json.
• Some node types are generated dynamically from resource types.
• This page covers major emitted families and the default built-in rule kinds.

Table of Contents

• Node Types
• Edge Types
• Dangerous Rule Edges

Node Types

Node Type	Meaning	Emitted By
GoogleUser	Human IAM principal (user:<email>)	users/groups + IAM binding stages
GoogleGroup	Group principal (group:<email>)	users/groups + IAM binding stages
GCPServiceAccount	Service account principal (serviceAccount:<email>)	IAM binding + resource expansion stages
GCPPrincipalSet	Principal set principal (principalSet://...)	IAM binding + resource expansion stages
GCPDomainPrincipal	Domain principal (domain:<domain>)	users/groups stage
GCPAllUsers / GCPAllAuthenticatedUsers	Global wildcard principal nodes	IAM binding stage
GCPPrincipal	Generic fallback principal type	IAM binding stage
GCPProject	Project resource node	IAM binding + resource expansion stages
GCPFolder	Folder resource node	IAM binding stage
GCPOrganization	Organization resource node	IAM binding stage
GCPIamSimpleBinding	Binding node used for principal -> binding -> resource modeling	IAM binding stage
GCPIamMultiBinding	Combo binding node for multi-permission rule matches	IAM binding multi-permission stage
GCPServiceAccountKey	Service account key node	resource expansion stage
GCPIamCapability	Optional intermediate capability node for combo-hop rules	IAM binding multi-permission stage
GCPIamBinding / GCPIamGrant	Compatibility/internal IAM graph node aliases used by styling and export logic	internal compatibility layer

Service-specific resource node types (major families)

Node Type	Example resource family
GCPBucket	Cloud Storage
GCPComputeInstance	Compute Engine
GCPCloudFunction	Cloud Functions
GCPCloudRunService, GCPCloudRunJob	Cloud Run
GCPCloudSQLInstance	Cloud SQL
GCPArtifactRegistryRepo	Artifact Registry
GCPBigQueryDataset, GCPBigQueryTable, GCPBigQueryRoutine	BigQuery
GCPPubSubTopic, GCPPubSubSubscription, GCPPubSubSchema, GCPPubSubSnapshot	Pub/Sub
GCPServiceDirectoryNamespace, GCPServiceDirectoryService	Service Directory
GCPCloudTasksQueue	Cloud Tasks
GCPKmsKeyRing, GCPKmsCryptoKey, GCPKmsCryptoKeyVersion	KMS
GCPSpannerInstance, GCPSpannerDatabase	Spanner
GCPSecret	Secret Manager

Edge Types

Edge Type	Meaning	Emitted By
GOOGLE_MEMBER_OF	Principal is a member of a Google Group	users/groups stage
DOMAIN_MEMBER_OF	Principal maps into a domain node by email suffix	users/groups stage
HAS_IAM_BINDING	Principal contributes to a binding node	IAM binding stage
HAS_COMBO_BINDING	Principal contributes to a combo binding node	IAM binding multi-permission stage
HAS_IMPLIED_PERMISSIONS	Principal contributes to an inferred-permission binding node	inferred-permissions stage
POLICY_BINDINGS	Generic binding-to-target edge (mainly visible with --include-all)	IAM binding stage
ROLE_OWNER / ROLE_EDITOR	Collapsed high-signal role edges for roles/owner and roles/editor	IAM binding stage
EXISTS_IN_PROJECT	Resource is modeled inside a project	resource expansion stage
EXECUTES_WITH	Compute instance executes as attached service account	resource expansion stage
GCP_SERVICE_ACCOUNT_KEY_FOR	Service account key belongs to service account	resource expansion stage
GCP_PRINCIPAL_SET	Principal set includes service account membership	resource expansion stage

Inferred edge family

Inferred-permissions builder emits edge kinds in this pattern:

• INFERRED_<EDGE_KIND>

Examples:

• INFERRED_RESET_COMPUTE_STARTUP_SA
• INFERRED_START_COMPUTE_STARTUP_SA
• INFERRED_CAN_MODIFY_PROJECT_IAM

Cloud Resource Manager ServiceAccount Principal Sets

OpenGraph expands Cloud Resource Manager principal sets for service accounts into explicit membership edges:

• principalSet://cloudresourcemanager.googleapis.com/projects/<PROJECT_NUMBER>/type/ServiceAccount
• principalSet://cloudresourcemanager.googleapis.com/folders/<FOLDER_NUMBER>/type/ServiceAccount
• principalSet://cloudresourcemanager.googleapis.com/organizations/<ORG_NUMBER>/type/ServiceAccount

Graph shape:

principalSet://cloudresourcemanager.googleapis.com/.../type/ServiceAccount
  -> GCP_PRINCIPAL_SET
  -> serviceAccount:<email>

Interpretation note:

• GCP_PRINCIPAL_SET only models principal-set membership, not permission grants by itself.
• Effective access still comes from the IAM binding path: principalSet://... -> HAS_IAM_BINDING -> binding -> target resource
• So even when a folder/org principal set member is bound at project scope, the grant still applies to that bound project resource (not arbitrary resources in other projects).

Reference: Google Cloud principal identifiers

Dangerous Rule Edges

These edge kinds come from gcpwn/mappings/og_privilege_escalation_paths.json.

Default single-permission rule edges

• CAN_MODIFY_PROJECT_IAM
• CAN_MODIFY_FOLDER_IAM
• CAN_MODIFY_ORG_IAM
• CAN_MODIFY_SA_IAM
• CAN_MODIFY_COMPUTE_INSTANCE_IAM
• CAN_MODIFY_ClOUD_RUN_FUNCTION_IAM
• CAN_IMPERSONATE_SA
• CAN_CREATE_SA_ACCESS_TOKEN
• CAN_CREATE_SA_KEY
• CAN_READ_SECRET_DATA

Default multi-permission rule edges

• RESET_COMPUTE_STARTUP_SA
• START_COMPUTE_STARTUP_SA
• CAN_RESET_COMPUTE_WITH_STARTUP_SCRIPT (hop edge used inside combo path)
• CAN_START_COMPUTE_WITH_STARTUP_SCRIPT (hop edge used inside combo path)

For rule definitions and customization workflow, see OpenGraph - Add Your Own Content.

Get Exact Types from Your Run

Because some edge kinds are rule-driven and some node types are data-driven, the exact set can vary by environment and flags.

Use SQL to enumerate what your current workspace actually emitted:

data sql --db service "SELECT DISTINCT node_type FROM opengraph_nodes ORDER BY node_type;"
data sql --db service "SELECT DISTINCT edge_type FROM opengraph_edges ORDER BY edge_type;"