rage.fail

gcp-batch-passidentity-actas

derived gcp emits CanPassIdentity

match (effective permission)

{ "action": "iam.serviceAccounts.actAs", "resource_type": "google.iam.ServiceAccount" }

where

?principal has batch.jobs.create in the target project/location

emit

source type	`Identity`
source	`<principal>`
target	`<chosen runtime service account>`
permissions	`iam.serviceAccounts.actAs`
conditions	`role_compatibility` `iam_permission`

Narrative

{principal.name} can set {sa.name} as the runtime SA of a Batch job it creates (iam.serviceAccounts.actAs).

Raw rule rules/derived/gcp/batch.yaml

id: gcp-batch-passidentity-actas
emits: CanPassIdentity
match_effective_permission:
  action: iam.serviceAccounts.actAs
  resource_type: google.iam.ServiceAccount
where:
- ?principal has batch.jobs.create in the target project/location
emit:
  source_type: Identity
  source: <principal>
  target: <chosen runtime service account>
  permissions:
  - iam.serviceAccounts.actAs
  conditions:
  - role_compatibility
  - iam_permission
  false_positive_note: 'actAs is per-SA: actAs on sa-a does NOT let you run as sa-b. Only emit for SAs
    the caller can actAs; no actAs -> POTENTIAL. The default Compute Engine SA also requires iam.serviceAccounts.actAs
    (per the official Batch custom-service-account guide) -- it is NOT an actAs-free shortcut.'
  narrative: '{principal.name} can set {sa.name} as the runtime SA of a Batch job it creates (iam.serviceAccounts.actAs).'