rage.fail

gcp-gce-set-service-account

derived gcp emits CanAttachIdentity

match (effective permission)

{ "action": "compute.instances.setServiceAccount", "resource_type": "compute.googleapis.com/Instance" }

where

?principal has iam.serviceAccounts.actAs on ?targetSA (roles/iam.serviceAccountUser) instance is STOPPED (setServiceAccount requires TERMINATED state)

emit

source type	`Identity`
target type	`Compute`
source	`<principal>`
target	`<instance>`
permissions	`compute.instances.setServiceAccount` `iam.serviceAccounts.actAs`
conditions	`iam_permission` `role_compatibility` `service_state`
state logic	ACTIVE if actAs held AND (instance stopped OR principal has compute.instances.stop+start) else CONDITIONAL(service_state)/POTENTIAL(iam_permission)

Narrative

{principal.name} can rebind {instance.name} to service account {sa.name} (compute.instances.setServiceAccount + iam.serviceAccounts.actAs), so code on it runs as that SA.

Raw rule rules/derived/gcp/gce.yaml

id: gcp-gce-set-service-account
emits: CanAttachIdentity
match_effective_permission:
  action: compute.instances.setServiceAccount
  resource_type: compute.googleapis.com/Instance
where:
- ?principal has iam.serviceAccounts.actAs on ?targetSA (roles/iam.serviceAccountUser)
- instance is STOPPED (setServiceAccount requires TERMINATED state)
emit:
  source_type: Identity
  target_type: Compute
  source: <principal>
  target: <instance>
  permissions:
  - compute.instances.setServiceAccount
  - iam.serviceAccounts.actAs
  conditions:
  - iam_permission
  - role_compatibility
  - service_state
  state_logic: ACTIVE if actAs held AND (instance stopped OR principal has compute.instances.stop+start)
    else CONDITIONAL(service_state)/POTENTIAL(iam_permission)
  false_positive_note: compute.instances.setServiceAccount without iam.serviceAccounts.actAs on the target
    SA is refused by GCE -> POTENTIAL, not ACTIVE. Requires the instance stopped.
  narrative: '{principal.name} can rebind {instance.name} to service account {sa.name} (compute.instances.setServiceAccount
    + iam.serviceAccounts.actAs), so code on it runs as that SA.'