gcp-composer-create-workload-as

Holding CanPassIdentity on a target SA plus composer.environments.create gives the principal the ability to create a Composer environment running as that SA.

derived gcp emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<target service account (?sa)>`
permissions	`composer.environments.create` `iam.serviceAccounts.actAs`
conditions	`role_compatibility` `iam_permission`
state logic	ACTIVE when both composer.environments.create and iam.serviceAccounts.actAs on ?sa are confirmed. CONDITIONAL(service_state) until the new environment reaches RUNNING state (creation takes 5-20 minutes). CONDITIONAL(iam_permission) if actAs is unresolved. BLOCKED if either permission is denied. Feeds can-execute-as execute-as-via-new-workload directly.

source type

Identity

target type

Identity

source

<principal>

target

<target service account (?sa)>

permissions

composer.environments.create iam.serviceAccounts.actAs

conditions

role_compatibility iam_permission

state logic

ACTIVE when both composer.environments.create and iam.serviceAccounts.actAs on ?sa are confirmed. CONDITIONAL(service_state) until the new environment reaches RUNNING state (creation takes 5-20 minutes). CONDITIONAL(iam_permission) if actAs is unresolved. BLOCKED if either permission is denied. Feeds can-execute-as execute-as-via-new-workload directly.

Narrative

{principal.name} can create a Composer environment (composer.environments.create + actAs on {sa.name}) bound to {sa.name}; once RUNNING, any DAG in the environment executes as {sa.name}.

Raw rule rules/derived/gcp/composer.yaml

id: gcp-composer-create-workload-as
emits: CanCreateWorkloadAs
description: Holding CanPassIdentity on a target SA plus composer.environments.create gives the principal
  the ability to create a Composer environment running as that SA.
match:
- - ?principal
  - CanPassIdentity
  - ?sa
where:
- ?principal has effective composer.environments.create on the project
- node_type(?sa) in [ServiceAccount, MachineIdentity]
- 'role_compatible(?sa, Composer Environment)  # SA must be valid for Composer env'
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <target service account (?sa)>
  permissions:
  - composer.environments.create
  - iam.serviceAccounts.actAs
  conditions:
  - role_compatibility
  - iam_permission
  state_logic: ACTIVE when both composer.environments.create and iam.serviceAccounts.actAs on ?sa are
    confirmed. CONDITIONAL(service_state) until the new environment reaches RUNNING state (creation takes
    5-20 minutes). CONDITIONAL(iam_permission) if actAs is unresolved. BLOCKED if either permission is
    denied. Feeds can-execute-as execute-as-via-new-workload directly.
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - <CanPassIdentity edge_id for ?principal -> ?sa>
  - <composer.environments.create effective permission>
  false_positive_note: Creating a Composer environment takes 5-20 minutes; CanExecuteAs derived from this
    CanCreateWorkloadAs is CONDITIONAL(service_state) until RUNNING. The environment creation also requires
    a GKE cluster and Cloud SQL instance to be provisioned; org policies or quota limits may block creation.
  narrative: '{principal.name} can create a Composer environment (composer.environments.create + actAs
    on {sa.name}) bound to {sa.name}; once RUNNING, any DAG in the environment executes as {sa.name}.'