gcp-vertexai-explicit-passidentity-actas
Principal holds iam.serviceAccounts.actAs on a service account (explicit permission normalization).
match (effective permission)
{
"action": "iam.serviceAccounts.actAs",
"resource_type": "google.iam.ServiceAccount"
}
emit
| source type | Identity |
|---|---|
| target type | ServiceAccount |
| source | <principal> |
| target | <target service account> |
| permissions | iam.serviceAccounts.actAs |
| state logic | ACTIVE when iam.serviceAccounts.actAs is confirmed on the target SA. POTENTIAL(iam_permission) if not confirmed. |
Raw rule rules/explicit/gcp-vertexai.yaml
id: gcp-vertexai-explicit-passidentity-actas
emits: CanPassIdentity
description: Principal holds iam.serviceAccounts.actAs on a service account (explicit permission normalization).
match_effective_permission:
action: iam.serviceAccounts.actAs
resource_type: google.iam.ServiceAccount
emit:
source_type: Identity
target_type: ServiceAccount
source: <principal>
target: <target service account>
permissions:
- iam.serviceAccounts.actAs
state_logic: ACTIVE when iam.serviceAccounts.actAs is confirmed on the target SA. POTENTIAL(iam_permission)
if not confirmed.
note: Explicit normalization of the iam.serviceAccounts.actAs permission into CanPassIdentity edge.
Without this edge, downstream CanCreateWorkloadAs rules cannot match.