gcp-vertexai-explicit-passidentity-actas

Principal holds iam.serviceAccounts.actAs on a service account (explicit permission normalization).

explicit gcp emits CanPassIdentity

match (effective permission)

{ "action": "iam.serviceAccounts.actAs", "resource_type": "google.iam.ServiceAccount" }

emit

source typeIdentity
target typeServiceAccount
source<principal>
target<target service account>
permissionsiam.serviceAccounts.actAs
state logicACTIVE when iam.serviceAccounts.actAs is confirmed on the target SA. POTENTIAL(iam_permission) if not confirmed.

Raw rule rules/explicit/gcp-vertexai.yaml

id: gcp-vertexai-explicit-passidentity-actas
emits: CanPassIdentity
description: Principal holds iam.serviceAccounts.actAs on a service account (explicit permission normalization).
match_effective_permission:
  action: iam.serviceAccounts.actAs
  resource_type: google.iam.ServiceAccount
emit:
  source_type: Identity
  target_type: ServiceAccount
  source: <principal>
  target: <target service account>
  permissions:
  - iam.serviceAccounts.actAs
  state_logic: ACTIVE when iam.serviceAccounts.actAs is confirmed on the target SA. POTENTIAL(iam_permission)
    if not confirmed.
  note: Explicit normalization of the iam.serviceAccounts.actAs permission into CanPassIdentity edge.
    Without this edge, downstream CanCreateWorkloadAs rules cannot match.
move · open · esc close