gcp-datafusion-create-workload-as

datafusion.instances.create + iam.serviceAccounts.actAs on a target SA: create a new Data Fusion instance whose pipelines execute as that SA.

derived gcp emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<target SA (?sa)>`
permissions	`datafusion.instances.create` `iam.serviceAccounts.actAs`
conditions	`iam_permission` `role_compatibility`
state logic	ACTIVE if both datafusion.instances.create and iam.serviceAccounts.actAs on ?sa are confirmed and role_compatible(?sa, new-datafusion-instance) holds. The downstream CanExecuteAs (can-execute-as execute-as-via-new-workload: CanCreateWorkloadAs → CanExecuteAs) is then ACTIVE. CONDITIONAL(iam_permission) if actAs is unresolved. BLOCKED if a deny policy applies.

source type

Identity

target type

Identity

source

<principal>

target

<target SA (?sa)>

permissions

datafusion.instances.create iam.serviceAccounts.actAs

conditions

iam_permission role_compatibility

state logic

ACTIVE if both datafusion.instances.create and iam.serviceAccounts.actAs on ?sa are confirmed and role_compatible(?sa, new-datafusion-instance) holds. The downstream CanExecuteAs (can-execute-as execute-as-via-new-workload: CanCreateWorkloadAs → CanExecuteAs) is then ACTIVE. CONDITIONAL(iam_permission) if actAs is unresolved. BLOCKED if a deny policy applies.

Narrative

{principal.name} can create a new Cloud Data Fusion instance (datafusion.instances.create) with dataprocServiceAccount={sa.name} (iam.serviceAccounts.actAs confirmed); any pipeline deployed to this instance will execute as {sa.name}.

Raw rule rules/derived/gcp/datastream.yaml

id: gcp-datafusion-create-workload-as
emits: CanCreateWorkloadAs
description: 'datafusion.instances.create + iam.serviceAccounts.actAs on a target SA: create a new Data
  Fusion instance whose pipelines execute as that SA.'
match:
- - ?principal
  - CanPassIdentity
  - ?sa
where:
- ?principal has effective datafusion.instances.create on the project
- node_type(?sa) in [ServiceAccount, MachineIdentity]
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <target SA (?sa)>
  permissions:
  - datafusion.instances.create
  - iam.serviceAccounts.actAs
  conditions:
  - iam_permission
  - role_compatibility
  state_logic: "ACTIVE if both datafusion.instances.create and iam.serviceAccounts.actAs on ?sa are confirmed\
    \ and role_compatible(?sa, new-datafusion-instance) holds. The downstream CanExecuteAs (can-execute-as\
    \ execute-as-via-new-workload: CanCreateWorkloadAs \u2192 CanExecuteAs) is then ACTIVE. CONDITIONAL(iam_permission)\
    \ if actAs is unresolved. BLOCKED if a deny policy applies."
  confidence: 0.9
  derived_from:
  - <CanPassIdentity edge_id for ?principal -> ?sa>
  - <datafusion.instances.create effective permission>
  false_positive_note: This emits CanCreateWorkloadAs for a NEW instance not yet existing. The SA must
    satisfy role_compatibility (hold roles/datafusion.runner + roles/dataproc.worker or equivalent). Executing
    pipelines on the new instance requires additional steps (pipeline deployment + trigger); model the
    CanExecuteAs as ACTIVE once the new instance exists and the pipeline code path is established.
  narrative: '{principal.name} can create a new Cloud Data Fusion instance (datafusion.instances.create)
    with dataprocServiceAccount={sa.name} (iam.serviceAccounts.actAs confirmed); any pipeline deployed
    to this instance will execute as {sa.name}.'