gcp-appengine-executes-as
An App Engine instance (Compute) runs as its configured (or default appspot) service account, inherited from the version's serviceAccount binding.
match (record)
{
"field": "serviceAccount",
"resource_type": "google.appengine.Instance"
}
where
?instance is an App Engine Instance (Compute); ?sa = the owning version.serviceAccount if set, else the default PROJECT_ID@appspot.gserviceaccount.com
emit
| source type | Compute |
|---|---|
| source | <App Engine instance> |
| target | <runtime service account> |
| conditions | service_state |
Narrative
App Engine instance {instance.name} runs as {sa.name}; code executing there acts with that SA's permissions.
Raw rule rules/derived/gcp/appengine.yaml
id: gcp-appengine-executes-as
emits: ExecutesAs
description: An App Engine instance (Compute) runs as its configured (or default appspot) service account,
inherited from the version's serviceAccount binding.
match_record:
resource_type: google.appengine.Instance
field: serviceAccount
where:
- ?instance is an App Engine Instance (Compute); ?sa = the owning version.serviceAccount if set, else
the default PROJECT_ID@appspot.gserviceaccount.com
emit:
source_type: Compute
source: <App Engine instance>
target: <runtime service account>
permissions: []
conditions:
- service_state
false_positive_note: 'ExecutesAs is anchored on the Instance node (Compute) per schema; the Version
node is a config carrier only (ApplicationPlatform, not a valid ExecutesAs source). The default appspot
SA is NOT always Editor: org policy iam.automaticIamGrantsForDefaultServiceAccounts or newer projects
disable the automatic grant. Resolve the SA''s ACTUAL role bindings to score escalation strength;
do not assume project-admin.
'
narrative: App Engine instance {instance.name} runs as {sa.name}; code executing there acts with that
SA's permissions.