gcp-composer-update-env-attach-sa

composer.environments.update + iam.serviceAccounts.actAs on a new SA: swap the Composer environment's runtime SA; future DAG tasks run as the new SA.

derived gcp emits CanAttachIdentity

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Compute`
source	`<principal>`
target	`<Composer Environment node>`
permissions	`composer.environments.update` `iam.serviceAccounts.actAs`
conditions	`iam_permission` `role_compatibility`
state logic	ACTIVE for the attach capability itself when both composer.environments.update and iam.serviceAccounts.actAs on ?new_sa are confirmed. The SA swap takes effect after the environment update completes (update propagation time: minutes). Downstream CanExecuteAs (from can-execute-as execute-as-via-config-identity-swap: CanModifyConfiguration + CanPassIdentity -> CanExecuteAs) is ACTIVE once the SA swap propagates. CONDITIONAL(iam_permission) if actAs on ?new_sa is unresolved. BLOCKED if either permission is denied by IAM deny or org policy.

source type

Identity

target type

Compute

source

<principal>

target

<Composer Environment node>

permissions

composer.environments.update iam.serviceAccounts.actAs

conditions

iam_permission role_compatibility

state logic

ACTIVE for the attach capability itself when both composer.environments.update and iam.serviceAccounts.actAs on ?new_sa are confirmed. The SA swap takes effect after the environment update completes (update propagation time: minutes). Downstream CanExecuteAs (from can-execute-as execute-as-via-config-identity-swap: CanModifyConfiguration + CanPassIdentity -> CanExecuteAs) is ACTIVE once the SA swap propagates. CONDITIONAL(iam_permission) if actAs on ?new_sa is unresolved. BLOCKED if either permission is denied by IAM deny or org policy.

Narrative

{principal.name} can update Composer environment {env.name} (composer.environments.update) to change its runtime SA to {new_sa.name} (iam.serviceAccounts.actAs confirmed); after the update, all future DAG task executions run as {new_sa.name}.

Raw rule rules/derived/gcp/composer.yaml

id: gcp-composer-update-env-attach-sa
emits: CanAttachIdentity
description: 'composer.environments.update + iam.serviceAccounts.actAs on a new SA: swap the Composer
  environment''s runtime SA; future DAG tasks run as the new SA.'
match:
- - ?principal
  - CanPassIdentity
  - ?new_sa
where:
- ?principal has effective composer.environments.update on the project or the environment
- node_type(?new_sa) in [ServiceAccount, MachineIdentity]
emit:
  source_type: Identity
  target_type: Compute
  source: <principal>
  target: <Composer Environment node>
  permissions:
  - composer.environments.update
  - iam.serviceAccounts.actAs
  conditions:
  - iam_permission
  - role_compatibility
  state_logic: 'ACTIVE for the attach capability itself when both composer.environments.update and iam.serviceAccounts.actAs
    on ?new_sa are confirmed. The SA swap takes effect after the environment update completes (update
    propagation time: minutes). Downstream CanExecuteAs (from can-execute-as execute-as-via-config-identity-swap:
    CanModifyConfiguration + CanPassIdentity -> CanExecuteAs) is ACTIVE once the SA swap propagates. CONDITIONAL(iam_permission)
    if actAs on ?new_sa is unresolved. BLOCKED if either permission is denied by IAM deny or org policy.'
  confidence: 0.93
  derived_from:
  - <CanPassIdentity edge_id for ?principal -> ?new_sa>
  - <composer.environments.update effective permission>
  false_positive_note: "Requires actAs on the NEW SA \u2014 without it the API rejects the update. Do\
    \ not emit CanAttachIdentity unless actAs on the new SA is confirmed via the CanPassIdentity edge\
    \ match. The SA swap only affects future DAG executions (not currently running tasks). Cite can-execute-as\
    \ execute-as-via-config-identity-swap for the CanExecuteAs roll-up."
  narrative: '{principal.name} can update Composer environment {env.name} (composer.environments.update)
    to change its runtime SA to {new_sa.name} (iam.serviceAccounts.actAs confirmed); after the update,
    all future DAG task executions run as {new_sa.name}.'