gcp-vertexai-cross-project-entry

A principal in project A can execute code as a SA that holds privilege in project B by submitting a training job or creating a notebook bound to that cross-project SA.

derived gcp emits CanEnterProject

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Project`
source	`<principal>`
target	`<project of the cross-project SA>`
permissions	`aiplatform.customJobs.create` `iam.serviceAccounts.actAs`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE if CanExecuteAs on the cross-project SA is ACTIVE AND org policy iam.disableCrossProjectServiceAccountUsage is NOT active. BLOCKED if the org policy is active (cross-project SA usage blocked). CONDITIONAL(iam_permission) if actAs on the SA is not fully confirmed.

source type

Identity

target type

Project

source

<principal>

target

<project of the cross-project SA>

permissions

aiplatform.customJobs.create iam.serviceAccounts.actAs

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE if CanExecuteAs on the cross-project SA is ACTIVE AND org policy iam.disableCrossProjectServiceAccountUsage is NOT active. BLOCKED if the org policy is active (cross-project SA usage blocked). CONDITIONAL(iam_permission) if actAs on the SA is not fully confirmed.

Narrative

{principal.name} can execute code as {sa.name} (from project {sa.project}) by submitting a Vertex AI job, entering project {sa.project} via the SA's cross-project IAM roles.

Raw rule rules/derived/gcp/vertexai.yaml

id: gcp-vertexai-cross-project-entry
emits: CanEnterProject
description: A principal in project A can execute code as a SA that holds privilege in project B by submitting
  a training job or creating a notebook bound to that cross-project SA.
match:
- - principal: null
  - CanExecuteAs
  - sa: null
where:
- ?sa.project != ?principal.project
- ?sa has IAM bindings granting meaningful roles in ?sa.project (or other projects)
emit:
  source_type: Identity
  target_type: Project
  source: <principal>
  target: <project of the cross-project SA>
  permissions:
  - aiplatform.customJobs.create
  - iam.serviceAccounts.actAs
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE if CanExecuteAs on the cross-project SA is ACTIVE AND org policy iam.disableCrossProjectServiceAccountUsage
    is NOT active. BLOCKED if the org policy is active (cross-project SA usage blocked). CONDITIONAL(iam_permission)
    if actAs on the SA is not fully confirmed.
  derived_from:
  - <CanExecuteAs edge_id>
  false_positive_note: Only emit when the SA is confirmed to be in a different project AND has meaningful
    IAM roles in that project. Org policy iam.disableCrossProjectServiceAccountUsage -> BLOCKED. Inherits
    state from CanExecuteAs; never stronger than the contributing edge.
  narrative: '{principal.name} can execute code as {sa.name} (from project {sa.project}) by submitting
    a Vertex AI job, entering project {sa.project} via the SA''s cross-project IAM roles.'