rage.fail

gcp-gcf-executes-as

derived gcp emits ExecutesAs

match (record)

{ "field": "serviceAccountEmail", "resource_type": "google.cloudfunctions.Function" }

where

runtime SA = serviceAccountEmail, or PROJECT_ID@appspot.gserviceaccount.com if unset

emit

source type	`Compute`
source	`<function>`
target	`<runtime service account>`

Narrative

{function.name} executes as runtime service account {sa.name}.

Raw rule rules/derived/gcp/gcf.yaml

id: gcp-gcf-executes-as
emits: ExecutesAs
match_record:
  resource_type: google.cloudfunctions.Function
  field: serviceAccountEmail
where:
- runtime SA = serviceAccountEmail, or PROJECT_ID@appspot.gserviceaccount.com if unset
emit:
  source_type: Compute
  source: <function>
  target: <runtime service account>
  permissions: []
  note: Zero-cost fact. Default appspot SA typically holds roles/editor.
  narrative: '{function.name} executes as runtime service account {sa.name}.'