gcp-orgpolicy-modify-sa-key-guardrail

id: gcp-orgpolicy-modify-sa-key-guardrail
emits: CanModifyPolicy
description: Remove/weaken iam.disableServiceAccountKeyCreation to re-enable SA key creation.
match:
- - principal: null
  - CanModifyPolicy
  - orgpolicy: null
where:
- node_class(?orgpolicy) == Policy and node_type(?orgpolicy) == OrganizationPolicy
- ?orgpolicy.constraint == 'constraints/iam.disableServiceAccountKeyCreation'
- ?orgpolicy is ENFORCED at/inherited-to ?scope (spec boolean enforce==true, not dryRun-only)
- ?principal has EFFECTIVE orgpolicy.policy.set at ?scope
emit:
  source_type: Identity
  target_type: '*'
  source: ?principal
  target: ?orgpolicy
  permissions:
  - orgpolicy.policy.set
  gates:
  - 'CanCreateCredentialFor(Identity -> ServiceAccount)  # SA JSON key / Cloud Storage HMAC key, emitted
    by gcp-sa-key-create'
  conditions:
  - guardrail_enforced
  - iam_permission
  state_logic: "ACTIVE for the CanModifyPolicy capability when orgpolicy.policy.set is unconditionally\
    \ effective at ?scope AND the constraint is currently enforced there. CONDITIONAL(iam_permission)\
    \ if the set permission is gated (IAM condition). BLOCKED if an IAM deny policy denies orgpolicy.policy.set\
    \ at ?scope. The downstream CanCreateCredentialFor upgrade from BLOCKED is NOT emitted here \u2014\
    \ guardrail-removal-upgrades- blocked re-emits it as CONDITIONAL(guardrail_removed)."
  confidence: min(contributing_confidences)
  derived_from:
  - ?principal CanModifyPolicy ?orgpolicy (orgpolicy.policy.set)
  - guardrail-removal-upgrades-blocked (hierarchy-chains.yaml) performs the BLOCKED->ACTIVE upgrade of
    the gated CanCreateCredentialFor
  false_positive_note: "Emit ONLY if the constraint is actually enforced at/above ?scope (check effective\
    \ policy via analyzeOrgPolicies, not raw per-scope spec \u2014 a child may override with inheritFromParent=false/reset)\
    \ AND at least one gcp-sa-key-create edge is BLOCKED by THIS OrganizationPolicy. A dry-run-only policy\
    \ enforces nothing. orgpolicy.policy.set is NOT resourcemanager.*.setIamPolicy \u2014 do not conflate\
    \ with the IAM self-grant. Power is bounded to SA-key creation in ?scope's subtree; do not generalize\
    \ to boundary control."
  narrative: "{principal.name} can set the org policy at {scope.name} (orgpolicy.policy.set) and remove/weaken\
    \ constraints/iam.disableServiceAccountKeyCreation, re-enabling service-account key creation across\
    \ {scope.name} \u2014 durable offline SA credentials become obtainable."