gcp-deploy-executes-as

id: gcp-deploy-executes-as
emits: ExecutesAs
description: Cloud Deploy job run worker (Cloud Build) executes as the target's configured execution service
  account.
applies_to:
- gcp
match_record:
  resource_type: google.cloud.deploy.Target
  field: executionConfigs[].serviceAccount
where:
- execution SA = executionConfigs[N].serviceAccount if set, ELSE the Compute Engine default SA (PROJECT_NUMBER-compute@developer.gserviceaccount.com)
emit:
  source_type: BuildWorker
  target_type: ServiceAccount
  source: <Cloud Deploy job run worker (BuildWorker) for this target>
  target: <execution service account>
  permissions: []
  state_logic: "ACTIVE \u2014 the binding is structural; any job run on this target executes as this SA."
  confidence: 0.98
  derived_from:
  - target.executionConfigs[N].serviceAccount field (or Compute Engine default SA)
  false_positive_note: "Confirm whether the target has an explicit executionConfigs.serviceAccount entry.\
    \ If absent, the runtime is the Compute Engine default SA \u2014 flag as high-privilege (roles/editor\
    \ by default). Do not assume least-privilege. If multiple executionConfigs entries exist (render vs\
    \ deploy pools), emit one ExecutesAs per pool/phase SA combination; the render SA and deploy SA may\
    \ differ."
  narrative: Cloud Deploy job runs for target {target.name} execute as {sa.name} inside a Cloud Build
    worker. Any code running in those workers (skaffold render, skaffold apply, pre/post-deploy hooks,
    verify) runs with {sa.name}'s GCP permissions.