rage.fail

gcp-gcf-attach-sa-via-update

derived gcp emits CanAttachIdentity

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanModifyConfiguration {'function': None} {'principal': None} CanPassIdentity {'sa': None}

where

node_type(?function) == ServerlessFunction ?principal has iam.serviceAccounts.actAs on ?sa

emit

source type	`Identity`
target type	`Compute`
source	`<principal>`
target	`<function>`
permissions	`cloudfunctions.functions.update` `iam.serviceAccounts.actAs`

Narrative

{principal.name} can change the runtime SA of {function.name} to {sa.name} (cloudfunctions.functions.update + actAs).

Raw rule rules/derived/gcp/gcf.yaml

id: gcp-gcf-attach-sa-via-update
emits: CanAttachIdentity
match:
- - principal: null
  - CanModifyConfiguration
  - function: null
- - principal: null
  - CanPassIdentity
  - sa: null
where:
- node_type(?function) == ServerlessFunction
- ?principal has iam.serviceAccounts.actAs on ?sa
emit:
  source_type: Identity
  target_type: Compute
  source: <principal>
  target: <function>
  permissions:
  - cloudfunctions.functions.update
  - iam.serviceAccounts.actAs
  note: "Chains to CanExecuteAs(?sa) once code is run \u2014 see gcp-gcf-execute-as-via-config."
  narrative: '{principal.name} can change the runtime SA of {function.name} to {sa.name} (cloudfunctions.functions.update
    + actAs).'