gcp-cloudbuild-executes-as

A Cloud Build trigger's builds execute as the configured service account (or the legacy SA if none is set).

derived gcp emits ExecutesAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Compute`
target type	`Identity`
source	`<Cloud Build trigger / build node (BuildWorker)>`
target	`<build service account (legacy or user-specified)>`
state logic	ACTIVE: structural fact — the build platform guarantees this SA token is injected into the build environment (metadata server). Flag the legacy SA as elevated privilege if it still holds roles/editor.

source type

Compute

target type

Identity

source

<Cloud Build trigger / build node (BuildWorker)>

target

<build service account (legacy or user-specified)>

state logic

ACTIVE: structural fact — the build platform guarantees this SA token is injected into the build environment (metadata server). Flag the legacy SA as elevated privilege if it still holds roles/editor.

Narrative

Cloud Build builds triggered by {trigger.name} execute as service account {sa.name}; all build steps can mint OAuth tokens for {sa.name} from the GCE metadata server.

Raw rule rules/derived/gcp/cloudbuild.yaml

id: gcp-cloudbuild-executes-as
emits: ExecutesAs
description: A Cloud Build trigger's builds execute as the configured service account (or the legacy SA
  if none is set).
match:
- - ?trigger
  - ExecutesAs
  - ?sa
where:
- node_type(?trigger) == BuildWorker
- 'if trigger.serviceAccount is set: SA = trigger.serviceAccount; else SA = PROJECT_NUMBER@cloudbuild.gserviceaccount.com
  (legacy SA)'
emit:
  source_type: Compute
  target_type: Identity
  source: <Cloud Build trigger / build node (BuildWorker)>
  target: <build service account (legacy or user-specified)>
  permissions: []
  conditions: []
  state_logic: "ACTIVE: structural fact \u2014 the build platform guarantees this SA token is injected\
    \ into the build environment (metadata server). Flag the legacy SA as elevated privilege if it still\
    \ holds roles/editor."
  confidence: 1.0
  derived_from:
  - <trigger.serviceAccount field from google.devtools.cloudbuild.v1.BuildTrigger resource>
  false_positive_note: "If serviceAccount field is absent, the legacy SA is the runtime identity \u2014\
    \ confirm the legacy SA's ACTUAL effective roles at collection time (org policy iam.automaticIamGrantsForDefaultServiceAccounts\
    \ may have removed roles/editor; always resolve effective roles, not defaults). Build-level serviceAccount\
    \ overrides trigger-level SA for direct builds."
  narrative: Cloud Build builds triggered by {trigger.name} execute as service account {sa.name}; all
    build steps can mint OAuth tokens for {sa.name} from the GCE metadata server.