gcp-run-set-runtime-sa
Set/replace the runtime SA on a Cloud Run resource (create or update) while holding actAs on that SA.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?principal has effective run.services.create OR run.services.update OR run.jobs.create OR run.jobs.update OR run.workerpools.create OR run.workerpools.update
?sa is the SA being attached as the runtime service identity (spec.serviceAccountName)
emit
| source type | Identity |
|---|---|
| target type | Compute |
| source | <principal> |
| target | <Cloud Run service/job/worker-pool> |
| permissions | iam.serviceAccounts.actAs run.services.update run.services.create run.jobs.update run.jobs.create |
| conditions | iam_permission |
Narrative
{principal.name} can attach service account {sa.name} to Cloud Run resource {resource.name} (iam.serviceAccounts.actAs + run.*.create/update).
Raw rule rules/derived/gcp/cloudrun.yaml
id: gcp-run-set-runtime-sa
emits: CanAttachIdentity
description: Set/replace the runtime SA on a Cloud Run resource (create or update) while holding actAs
on that SA.
match:
- - ?principal
- CanPassIdentity
- ?sa
where:
- ?principal has effective run.services.create OR run.services.update OR run.jobs.create OR run.jobs.update
OR run.workerpools.create OR run.workerpools.update
- ?sa is the SA being attached as the runtime service identity (spec.serviceAccountName)
emit:
source_type: Identity
target_type: Compute
source: <principal>
target: <Cloud Run service/job/worker-pool>
permissions:
- iam.serviceAccounts.actAs
- run.services.update
- run.services.create
- run.jobs.update
- run.jobs.create
conditions:
- iam_permission
false_positive_note: 'actAs is the guard rail: without iam.serviceAccounts.actAs on ?sa the deploy is
denied. Do not emit for an arbitrary SA the principal cannot actAs. role_compatibility is intentionally
omitted: Cloud Run imposes no SA/service compatibility restriction (any SA can be a Cloud Run runtime
SA), so the only load-bearing precondition is the actAs check (iam_permission).'
narrative: '{principal.name} can attach service account {sa.name} to Cloud Run resource {resource.name}
(iam.serviceAccounts.actAs + run.*.create/update).'