gcp-dataproc-create-workload-as

Create a new Dataproc cluster whose VMs run as a chosen SA (clusters.create + actAs); submit a job to execute code as that SA.

derived gcp emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`ServiceAccount`
source	`?principal`
target	`?sa`
permissions	`dataproc.clusters.create` `iam.serviceAccounts.actAs`
conditions	`iam_permission` `role_compatibility`
state logic	ACTIVE when both CanPassIdentity and dataproc.clusters.create are confirmed; POTENTIAL(iam_permission) when either permission is unconfirmed; BLOCKED when org policy restricts SA or IAM deny blocks clusters.create or actAs. Submit a job to the newly created cluster to trigger code execution (job submission itself is ACTIVE, no trigger_exists condition — cluster starts running on creation).

source type

Identity

target type

ServiceAccount

source

?principal

target

?sa

permissions

dataproc.clusters.create iam.serviceAccounts.actAs

conditions

iam_permission role_compatibility

state logic

ACTIVE when both CanPassIdentity and dataproc.clusters.create are confirmed; POTENTIAL(iam_permission) when either permission is unconfirmed; BLOCKED when org policy restricts SA or IAM deny blocks clusters.create or actAs. Submit a job to the newly created cluster to trigger code execution (job submission itself is ACTIVE, no trigger_exists condition — cluster starts running on creation).

Narrative

{principal.name} can create a Dataproc cluster (dataproc.clusters.create) whose VMs run as {sa.name} (iam.serviceAccounts.actAs), then submit a job to execute arbitrary code as {sa.name}.

Raw rule rules/derived/gcp/dataproc.yaml

id: gcp-dataproc-create-workload-as
emits: CanCreateWorkloadAs
description: Create a new Dataproc cluster whose VMs run as a chosen SA (clusters.create + actAs); submit
  a job to execute code as that SA.
match:
- - principal: null
  - CanPassIdentity
  - sa: null
where:
- ?principal has dataproc.clusters.create in the target project/region
- ?principal has iam.serviceAccounts.actAs on ?sa
- node_type(?sa) == ServiceAccount
emit:
  source_type: Identity
  target_type: ServiceAccount
  source: ?principal
  target: ?sa
  permissions:
  - dataproc.clusters.create
  - iam.serviceAccounts.actAs
  conditions:
  - iam_permission
  - role_compatibility
  state_logic: "ACTIVE when both CanPassIdentity and dataproc.clusters.create are confirmed; POTENTIAL(iam_permission)\
    \ when either permission is unconfirmed; BLOCKED when org policy restricts SA or IAM deny blocks clusters.create\
    \ or actAs. Submit a job to the newly created cluster to trigger code execution (job submission itself\
    \ is ACTIVE, no trigger_exists condition \u2014 cluster starts running on creation)."
  derived_from:
  - ?principal CanPassIdentity ?sa (gcp-dataproc-explicit-can-pass-identity)
  false_positive_note: CITE can-execute-as execute-as-via-new-workload for the CanExecuteAs derivation.
    actAs is per-SA; without it -> POTENTIAL. Org policy dataproc.clusterProjectScopeServiceAccountUsage
    can block cross-project SA use.
  narrative: '{principal.name} can create a Dataproc cluster (dataproc.clusters.create) whose VMs run
    as {sa.name} (iam.serviceAccounts.actAs), then submit a job to execute arbitrary code as {sa.name}.'