gcp-bigquery-explicit-can-pass-identity
iam.serviceAccounts.actAs on a target SA enables re-binding which SA a scheduled query runs as.
match (effective permission)
{
"action": "iam.serviceAccounts.actAs",
"resource_type": "google.iam.ServiceAccount"
}
emit
| source type | Identity |
|---|---|
| target type | ServiceAccount |
| source | <principal> |
| target | <target service account> |
| permissions | iam.serviceAccounts.actAs |
| conditions | iam_permission role_compatibility |
| state logic | ACTIVE when iam.serviceAccounts.actAs on the target SA is ACTIVE effective permission; CONDITIONAL(iam_permission) when the permission is uncertain or scoped away. |
Narrative
{principal.name} can impersonate {sa.name} via iam.serviceAccounts.actAs, enabling re-binding of scheduled queries or other workloads to run as {sa.name}.
Raw rule rules/explicit/gcp/bigquery.yaml
id: gcp-bigquery-explicit-can-pass-identity
emits: CanPassIdentity
description: iam.serviceAccounts.actAs on a target SA enables re-binding which SA a scheduled query runs
as.
match_effective_permission:
action: iam.serviceAccounts.actAs
resource_type: google.iam.ServiceAccount
emit:
source_type: Identity
target_type: ServiceAccount
source: <principal>
target: <target service account>
permissions:
- iam.serviceAccounts.actAs
conditions:
- iam_permission
- role_compatibility
state_logic: ACTIVE when iam.serviceAccounts.actAs on the target SA is ACTIVE effective permission;
CONDITIONAL(iam_permission) when the permission is uncertain or scoped away.
false_positive_note: 'actAs is per-SA: actAs on SA-A does not allow binding SA-B. Only emit for each
SA the principal has explicit iam.serviceAccounts.actAs on. Without actAs, the BigQuery DTS API rejects
the serviceAccountName update with a 403. When combined with bigquery.transfers.update, this enables
CanPassIdentity to re-bind the scheduled query to run as a different (privileged) SA.'
narrative: '{principal.name} can impersonate {sa.name} via iam.serviceAccounts.actAs, enabling re-binding
of scheduled queries or other workloads to run as {sa.name}.'
derived_from:
- iam.serviceAccounts.actAs effective permission on target SA
api_source: Cloud Asset Inventory analyzeIamPolicy
evidence_field: iam.serviceAccounts.actAs effective permission