gcp-deploy-automation-create-triggers

clouddeploy.automations.create with a promoteReleaseRule or advanceRolloutRule schedules automatic rollout creation, effectively giving CanTrigger over the deploy Cloud Build worker.

derived gcp emits CanTrigger

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'automation_sa': None}

where

?principal has effective clouddeploy.automations.create on the delivery pipeline ?automation_sa is the SA specified in the automation's serviceAccount field ?automation_sa itself holds clouddeploy.rollouts.create on the pipeline + iam.serviceAccounts.actAs on the deploy SA

emit

source type	`Identity`
target type	`BuildWorker`
source	`?principal`
target	`<deploy-phase Cloud Build worker (BuildWorker) triggered by the automation>`
permissions	`clouddeploy.automations.create` `iam.serviceAccounts.actAs`
conditions	`iam_permission`
state logic	ACTIVE when ?principal holds clouddeploy.automations.create AND CanPassIdentity on ?automation_sa is ACTIVE AND ?automation_sa has effective rollouts.create + actAs on the deploy SA. CONDITIONAL(iam_permission) when the automation SA's downstream permissions are unconfirmed. CONDITIONAL(time_window) when the automation uses a cron schedule (it fires in the future, not immediately). A deploy policy on the pipeline targeting the automated action => CONDITIONAL(time_window) — the automation run is blocked during the policy window but fires outside it. BLOCKED when IAM deny policy denies automations.create.

Narrative

{principal.name} can create a Cloud Deploy automation (clouddeploy.automations.create) configured to automatically promote releases in pipeline {pipeline.name}, using automation SA {automation_sa.name} (actAs required). This schedules automatic rollout creation, effectively giving {principal.name} persistent CanTrigger over the pipeline without manual promotion. cicd-chains cicd-trigger-runner-executes-as then collapses this CanTrigger + ExecutesAs(worker → deploy SA) into CanExecuteAs.

Raw rule rules/derived/gcp/clouddeploy.yaml

id: gcp-deploy-automation-create-triggers
emits: CanTrigger
description: clouddeploy.automations.create with a promoteReleaseRule or advanceRolloutRule schedules
  automatic rollout creation, effectively giving CanTrigger over the deploy Cloud Build worker.
applies_to:
- gcp
match:
- - principal: null
  - CanPassIdentity
  - automation_sa: null
where:
- ?principal has effective clouddeploy.automations.create on the delivery pipeline
- ?automation_sa is the SA specified in the automation's serviceAccount field
- ?automation_sa itself holds clouddeploy.rollouts.create on the pipeline + iam.serviceAccounts.actAs
  on the deploy SA
emit:
  source_type: Identity
  target_type: BuildWorker
  source: ?principal
  target: <deploy-phase Cloud Build worker (BuildWorker) triggered by the automation>
  permissions:
  - clouddeploy.automations.create
  - iam.serviceAccounts.actAs
  conditions:
  - iam_permission
  state_logic: "ACTIVE when ?principal holds clouddeploy.automations.create AND CanPassIdentity on ?automation_sa\
    \ is ACTIVE AND ?automation_sa has effective rollouts.create + actAs on the deploy SA. CONDITIONAL(iam_permission)\
    \ when the automation SA's downstream permissions are unconfirmed. CONDITIONAL(time_window) when the\
    \ automation uses a cron schedule (it fires in the future, not immediately). A deploy policy on the\
    \ pipeline targeting the automated action => CONDITIONAL(time_window) \u2014 the automation run is\
    \ blocked during the policy window but fires outside it. BLOCKED when IAM deny policy denies automations.create."
  confidence: 0.82
  derived_from:
  - ?principal CanPassIdentity ?automation_sa (gcp-sa-act-as)
  - clouddeploy.automations.create effective permission
  - ?automation_sa clouddeploy.rollouts.create + actAs chain
  false_positive_note: An automation only yields privilege when the automation SA itself can promote (rollouts.create
    + actAs on deploy SA). If the automation SA has only clouddeploy.automationRuns.cancel or read-only
    perms, the automation cannot produce rollouts. Verify the automation SA's effective permissions before
    emitting. Cron-based automations are CanSchedule semantics more than CanTrigger; both are emitted
    for completeness. Deploy policy restrictions are CONDITIONAL, not BLOCKED.
  narrative: "{principal.name} can create a Cloud Deploy automation (clouddeploy.automations.create) configured\
    \ to automatically promote releases in pipeline {pipeline.name}, using automation SA {automation_sa.name}\
    \ (actAs required). This schedules automatic rollout creation, effectively giving {principal.name}\
    \ persistent CanTrigger over the pipeline without manual promotion. cicd-chains cicd-trigger-runner-executes-as\
    \ then collapses this CanTrigger + ExecutesAs(worker \u2192 deploy SA) into CanExecuteAs."