gcp-wif-binding-maps-to-sa

id: gcp-wif-binding-maps-to-sa
emits: ExternalIdentityMapsTo
applies_to:
- gcp
match_record:
  resource_type: google.iam.ServiceAccount
  field: iamPolicy.bindings[role=roles/iam.workloadIdentityUser].members
where:
- member is principal://iam.googleapis.com/<POOL>/subject/<s> OR principalSet://iam.googleapis.com/<POOL>/attribute.<x>/<v>
  (or group/*)
emit:
  source_type: ExternalIdentity
  target_type: ServiceAccount
  source: '<ExternalIdentity: the principal:// / principalSet:// member of the WIF pool>'
  target: <impersonated ServiceAccount>
  api_source: iam.serviceAccounts.getIamPolicy
  evidence_field: bindings[role=roles/iam.workloadIdentityUser].members
  properties:
    member: <principal:// or principalSet:// member expression>
    subject_pinned: <true if principal://.../subject/<exact>; false if principalSet://.../attribute.*/
      , .../subject/* , or .../* (BROAD)>
    attribute_scope: <the attribute the principalSet is keyed on (subject/aud/repository/...)>
  false_positive_note: 'The subject_pinned property is THE gate for the derived takeover: a principalSet://
    member keyed on an attribute (attribute.aud, attribute.repository/*) or on subject/* accepts ANY workload
    from the issuer => subject_pinned=false => derived rule ACTIVE. A principal://.../subject/<exact-subject>
    is subject_pinned=true => CONDITIONAL(trust_condition). Also honor roles/iam.serviceAccountTokenCreator
    granted to a principalSet:// member (same effect). Do not emit for bindings whose member is a normal
    Google user/SA (not a WIF principal:// / principalSet://).'
  narrative: External WIF principal {member} maps to service account {sa.name} via roles/iam.workloadIdentityUser
    (subject_pinned={subject_pinned}).