rage.fail

gcp-appengine-actas-passidentity

derived gcp emits CanPassIdentity

match (effective permission)

{ "action": "iam.serviceAccounts.actAs", "resource_type": "google.iam.ServiceAccount" }

emit

source type	`Identity`
source	`<principal>`
target	`<service account>`
permissions	`iam.serviceAccounts.actAs`
conditions	`iam_permission` `role_compatibility`

Narrative

{principal.name} can attach {sa.name} as the runtime identity of an App Engine version it deploys (iam.serviceAccounts.actAs).

Raw rule rules/derived/gcp/appengine.yaml

id: gcp-appengine-actas-passidentity
emits: CanPassIdentity
match_effective_permission:
  action: iam.serviceAccounts.actAs
  resource_type: google.iam.ServiceAccount
emit:
  source_type: Identity
  source: <principal>
  target: <service account>
  permissions:
  - iam.serviceAccounts.actAs
  conditions:
  - iam_permission
  - role_compatibility
  note: actAs alone is not execution; pairs with appengine.versions.create/update setting version.serviceAccount
    -> CanExecuteAs.
  false_positive_note: actAs is per-SA. A principal able to actAs only the appspot SA cannot attach an
    arbitrary stronger SA to a version.
  narrative: '{principal.name} can attach {sa.name} as the runtime identity of an App Engine version it
    deploys (iam.serviceAccounts.actAs).'