rage.fail

gcp-sa-sign-blob-jwt

derived gcp emits CanSignAs

match (effective permission)

{ "action": "iam.serviceAccounts.signJwt", "resource_type": "google.iam.ServiceAccount" }

emit

source type	`Identity`
source	`<principal>`
target	`<service account>`
permissions	`iam.serviceAccounts.signJwt` `iam.serviceAccounts.signBlob`

Narrative

{principal.name} can sign JWTs/blobs as {sa.name} (signJwt/signBlob) and self-assert as that SA.

Raw rule rules/derived/gcp/identity-escalation.yaml

id: gcp-sa-sign-blob-jwt
emits: CanSignAs
match_effective_permission:
  action: iam.serviceAccounts.signJwt
  resource_type: google.iam.ServiceAccount
alt_permission: iam.serviceAccounts.signBlob
emit:
  source_type: Identity
  source: <principal>
  target: <service account>
  permissions:
  - iam.serviceAccounts.signJwt
  - iam.serviceAccounts.signBlob
  escalation: Sign a JWT as the SA and exchange it for an access token -> impersonation.
  narrative: '{principal.name} can sign JWTs/blobs as {sa.name} (signJwt/signBlob) and self-assert as
    that SA.'