rage.fail

gcp-sa-implicit-delegation

derived gcp emits CanImpersonate

match (effective permission)

{ "action": "iam.serviceAccounts.implicitDelegation", "resource_type": "google.iam.ServiceAccount" }

emit

source	`<principal>`
target	`<service account>`
permissions	`iam.serviceAccounts.implicitDelegation`

Narrative

{principal.name} can use implicit delegation through {sa.name} to reach SAs it can token.

Raw rule rules/derived/gcp/identity-escalation.yaml

id: gcp-sa-implicit-delegation
emits: CanImpersonate
match_effective_permission:
  action: iam.serviceAccounts.implicitDelegation
  resource_type: google.iam.ServiceAccount
emit:
  source: <principal>
  target: <service account>
  permissions:
  - iam.serviceAccounts.implicitDelegation
  note: 'Delegation chain: A->B implicitDelegation, B has getAccessToken on C => A reaches C. Fixpoint
    handles the chain.'
  narrative: '{principal.name} can use implicit delegation through {sa.name} to reach SAs it can token.'