gcp-gce-executes-as-sa
Instance runs as the SA in its serviceAccounts[] config.
match (record)
{
"field": "serviceAccounts[].email",
"resource_type": "compute.googleapis.com/Instance"
}
emit
| source type | Compute |
|---|---|
| source | <instance> |
| target | <attached service account> |
Narrative
{instance.name} executes as service account {sa.name} (attached in serviceAccounts[]), whose OAuth token is vended by the metadata server.
Raw rule rules/derived/gcp/gce.yaml
id: gcp-gce-executes-as-sa
emits: ExecutesAs
description: Instance runs as the SA in its serviceAccounts[] config.
match_record:
resource_type: compute.googleapis.com/Instance
field: serviceAccounts[].email
emit:
source_type: Compute
source: <instance>
target: <attached service account>
permissions: []
note: Zero-cost fact. Default SA (PROJECT_NUMBER-compute@developer.gserviceaccount.com) often holds
roles/editor.
narrative: '{instance.name} executes as service account {sa.name} (attached in serviceAccounts[]), whose
OAuth token is vended by the metadata server.'