rage.fail

gcp-appengine-instance-token

Code running in an App Engine instance can read the runtime SA token from the GCE metadata server.

derived gcp emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'instance': None} ExecutesAs {'sa': None}

emit

source	`<App Engine instance>`
target	`<runtime service account>`

Narrative

Code on App Engine instance {instance.name} can retrieve an access token for {sa.name} from the metadata server.

Raw rule rules/derived/gcp/appengine.yaml

id: gcp-appengine-instance-token
emits: CanRetrieveToken
description: Code running in an App Engine instance can read the runtime SA token from the GCE metadata
  server.
match:
- - instance: null
  - ExecutesAs
  - sa: null
emit:
  source: <App Engine instance>
  target: <runtime service account>
  permissions: []
  note: 'Intrinsic: 169.254.169.254 /computeMetadata/v1/.../token. Realizes usable SA creds once code
    exec is achieved.'
  narrative: Code on App Engine instance {instance.name} can retrieve an access token for {sa.name} from
    the metadata server.