rage.fail

gcp-sa-act-as

derived gcp emits CanPassIdentity

match (effective permission)

{ "action": "iam.serviceAccounts.actAs", "resource_type": "google.iam.ServiceAccount" }

emit

source type	`Identity`
source	`<principal>`
target	`<service account>`
permissions	`iam.serviceAccounts.actAs`

Narrative

{principal.name} can attach {sa.name} to a workload it deploys (iam.serviceAccounts.actAs).

Raw rule rules/derived/gcp/identity-escalation.yaml

id: gcp-sa-act-as
emits: CanPassIdentity
match_effective_permission:
  action: iam.serviceAccounts.actAs
  resource_type: google.iam.ServiceAccount
emit:
  source_type: Identity
  source: <principal>
  target: <service account>
  permissions:
  - iam.serviceAccounts.actAs
  note: actAs alone is not execution; pairs with a create/deploy action (gce/gcf/run/cloudbuild) -> CanExecuteAs.
  narrative: '{principal.name} can attach {sa.name} to a workload it deploys (iam.serviceAccounts.actAs).'