rage.fail

gcp-sa-get-access-token

derived gcp emits CanImpersonate

match (effective permission)

{ "action": "iam.serviceAccounts.getAccessToken", "resource_type": "google.iam.ServiceAccount" }

emit

source type	`Identity`
source	`<principal>`
target	`<service account in scope>`
permissions	`iam.serviceAccounts.getAccessToken`

Narrative

{principal.name} can mint access tokens for {sa.name} (iam.serviceAccounts.getAccessToken) and act with all of its permissions.

Raw rule rules/derived/gcp/identity-escalation.yaml

id: gcp-sa-get-access-token
emits: CanImpersonate
match_effective_permission:
  action: iam.serviceAccounts.getAccessToken
  resource_type: google.iam.ServiceAccount
emit:
  source_type: Identity
  source: <principal>
  target: <service account in scope>
  permissions:
  - iam.serviceAccounts.getAccessToken
  escalation: Mint an OAuth2 token for the SA and inherit ALL of its roles.
  note: Also emit CanAssume for cross-provider consistency. This is the GCP privesc workhorse.
  narrative: '{principal.name} can mint access tokens for {sa.name} (iam.serviceAccounts.getAccessToken)
    and act with all of its permissions.'