gcp-eventarc-passidentity-actas
actAs on a SA that the principal can configure as the trigger's serviceAccount is the GCP PassRole analog for Eventarc trigger SA assignment.
match (effective permission)
{
"action": "iam.serviceAccounts.actAs",
"resource_type": "google.iam.ServiceAccount"
}
where
principal holds eventarc.triggers.create OR eventarc.triggers.update in the same project/location scope
emit
| source type | Identity |
|---|---|
| target type | ServiceAccount |
| source | <principal> |
| target | <service account> |
| permissions | iam.serviceAccounts.actAs |
| conditions | role_compatibility iam_permission |
Narrative
{principal.name} holds iam.serviceAccounts.actAs on {sa.name} and can configure it as the serviceAccount of an Eventarc trigger it creates or updates.
Raw rule rules/derived/gcp/eventarc.yaml
id: gcp-eventarc-passidentity-actas
emits: CanPassIdentity
description: actAs on a SA that the principal can configure as the trigger's serviceAccount is the GCP
PassRole analog for Eventarc trigger SA assignment.
match_effective_permission:
action: iam.serviceAccounts.actAs
resource_type: google.iam.ServiceAccount
where:
- principal holds eventarc.triggers.create OR eventarc.triggers.update in the same project/location scope
emit:
source_type: Identity
target_type: ServiceAccount
source: <principal>
target: <service account>
permissions:
- iam.serviceAccounts.actAs
conditions:
- role_compatibility
- iam_permission
derived_from:
- 'effective permission: iam.serviceAccounts.actAs on the service account'
- 'CITE: gcp-sa-act-as (generic actAs rule)'
false_positive_note: 'This rule de-dupes with gcp-sa-act-as (generic iam.serviceAccounts.actAs rule)
on (CanPassIdentity, ?principal, ?sa). The engine emits once per unique edge; the generic rule already
covers all actAs grants. This Eventarc-scoped narrative is for analyst clarity. actAs is per-SA: actAs
on SA-A does NOT allow configuring SA-B as the trigger SA. Only emit for SAs the principal can actAs.
The principal must also hold eventarc.triggers.create or .update to actually use the actAs for an
Eventarc trigger.'
narrative: '{principal.name} holds iam.serviceAccounts.actAs on {sa.name} and can configure it as the
serviceAccount of an Eventarc trigger it creates or updates.'