rage.fail

gcp-gcf-passidentity-actas

derived gcp emits CanPassIdentity

match (effective permission)

{ "action": "iam.serviceAccounts.actAs", "resource_type": "google.iam.ServiceAccount" }

where

?principal can create or update a function (cloudfunctions.functions.create/update)

emit

source type	`Identity`
source	`<principal>`
target	`<runtime service account>`
permissions	`iam.serviceAccounts.actAs`
conditions	`role_compatibility` `iam_permission`

Narrative

{principal.name} can attach {sa.name} to a function it deploys (iam.serviceAccounts.actAs).

Raw rule rules/derived/gcp/gcf.yaml

id: gcp-gcf-passidentity-actas
emits: CanPassIdentity
alias_of: gcp-sa-act-as
dedupe_on: edge_id
match_effective_permission:
  action: iam.serviceAccounts.actAs
  resource_type: google.iam.ServiceAccount
where:
- ?principal can create or update a function (cloudfunctions.functions.create/update)
emit:
  source_type: Identity
  source: <principal>
  target: <runtime service account>
  permissions:
  - iam.serviceAccounts.actAs
  conditions:
  - role_compatibility
  - iam_permission
  false_positive_note: 'Scoped alias of gcp-sa-act-as - de-duped on edge_id (type|source|target|scope)
    so no duplicate CanPassIdentity edge is produced. actAs is per-SA: actAs on sa-a does NOT let you
    attach sa-b. Only emit for SAs the caller can actAs; no actAs -> POTENTIAL.'
  narrative: '{principal.name} can attach {sa.name} to a function it deploys (iam.serviceAccounts.actAs).'