gcp-cloudscheduler-passidentity-actas
actAs on a SA that the principal names in an HTTP job's oidcToken.serviceAccountEmail or oauthToken.serviceAccountEmail is the GCP PassRole analog for Cloud Scheduler. Required to create or update a job with an authenticated HTTP target.
match (effective permission)
{
"action": "iam.serviceAccounts.actAs",
"resource_type": "google.iam.ServiceAccount"
}
where
principal can create or update a Cloud
Scheduler job (cloudscheduler.jobs.create or cloudscheduler.jobs.update in scope)
emit
| source type | Identity |
|---|---|
| target type | ServiceAccount |
| source | <principal> |
| target | <service account named in oidcToken.serviceAccountEmail or oauthToken.serviceAccountEmail> |
| permissions | iam.serviceAccounts.actAs |
| conditions | role_compatibility iam_permission |
| state logic | ACTIVE when the principal holds iam.serviceAccounts.actAs on the specified SA AND can create or update a Cloud Scheduler job. POTENTIAL(role_compatibility) when the actAs grant on the SA is unknown/unresolved. |
Narrative
{principal.name} holds iam.serviceAccounts.actAs on {sa.name} and can bind it as the OIDC/OAuth2 authentication identity of a Cloud Scheduler HTTP job it creates or updates. Every scheduled HTTP request will carry {sa.name}'s bearer token.
Raw rule rules/derived/gcp/cloudscheduler.yaml
id: gcp-cloudscheduler-passidentity-actas
emits: CanPassIdentity
alias_of: gcp-sa-act-as
dedupe_on: edge_id
description: actAs on a SA that the principal names in an HTTP job's oidcToken.serviceAccountEmail or
oauthToken.serviceAccountEmail is the GCP PassRole analog for Cloud Scheduler. Required to create or
update a job with an authenticated HTTP target.
match_effective_permission:
action: iam.serviceAccounts.actAs
resource_type: google.iam.ServiceAccount
where:
- principal can create or update a Cloud Scheduler job (cloudscheduler.jobs.create or cloudscheduler.jobs.update
in scope)
emit:
source_type: Identity
target_type: ServiceAccount
source: <principal>
target: <service account named in oidcToken.serviceAccountEmail or oauthToken.serviceAccountEmail>
permissions:
- iam.serviceAccounts.actAs
derived_from:
- 'effective permission: iam.serviceAccounts.actAs on the service account'
conditions:
- role_compatibility
- iam_permission
state_logic: ACTIVE when the principal holds iam.serviceAccounts.actAs on the specified SA AND can create
or update a Cloud Scheduler job. POTENTIAL(role_compatibility) when the actAs grant on the SA is unknown/unresolved.
false_positive_note: "Scoped alias of gcp-sa-act-as \u2014 dedupe on edge_id so no duplicate CanPassIdentity\
\ edge is produced. actAs is per-SA: actAs on SA-A does NOT grant actAs on SA-B. This actAs requirement\
\ applies ONLY to HTTP-authenticated jobs (oidcToken or oauthToken set). Pub/Sub target jobs do NOT\
\ require actAs \u2014 the Cloud Scheduler service agent publishes via its own managed identity; only\
\ cloudscheduler.jobs.create is needed for a Pub/Sub job. Do not emit CanPassIdentity for Pub/Sub-only\
\ jobs."
narrative: '{principal.name} holds iam.serviceAccounts.actAs on {sa.name} and can bind it as the OIDC/OAuth2
authentication identity of a Cloud Scheduler HTTP job it creates or updates. Every scheduled HTTP
request will carry {sa.name}''s bearer token.'