rage.fail

gcp-sa-get-openid-token

derived gcp emits CanRetrieveToken

match (effective permission)

{ "action": "iam.serviceAccounts.getOpenIdToken", "resource_type": "google.iam.ServiceAccount" }

emit

source	`<principal>`
target	`<service account>`
permissions	`iam.serviceAccounts.getOpenIdToken`

Narrative

{principal.name} can mint OIDC identity tokens for {sa.name} (useful against IAP/Cloud Run/other OIDC-trusting services).

Raw rule rules/derived/gcp/identity-escalation.yaml

id: gcp-sa-get-openid-token
emits: CanRetrieveToken
match_effective_permission:
  action: iam.serviceAccounts.getOpenIdToken
  resource_type: google.iam.ServiceAccount
emit:
  source: <principal>
  target: <service account>
  permissions:
  - iam.serviceAccounts.getOpenIdToken
  narrative: '{principal.name} can mint OIDC identity tokens for {sa.name} (useful against IAP/Cloud Run/other
    OIDC-trusting services).'