rage.fail

gcp-wif-pool-contains-provider

explicit gcp emits Contains

match (record)

{ "field": "providers", "resource_type": "iam.WorkloadIdentityPool" }

emit

source type	`AdministrativeBoundary`
target type	`*`
source	`<WorkloadIdentityPool (AdministrativeBoundary / GenericBoundary) node>`
target	`<WorkloadIdentityPoolProvider node>`

Narrative

{pool.name} contains workload identity pool provider {provider.name}.

Raw rule rules/explicit/gcp-wif.yaml

id: gcp-wif-pool-contains-provider
emits: Contains
applies_to:
- gcp
match_record:
  resource_type: iam.WorkloadIdentityPool
  field: providers
emit:
  source_type: AdministrativeBoundary
  target_type: '*'
  source: <WorkloadIdentityPool (AdministrativeBoundary / GenericBoundary) node>
  target: <WorkloadIdentityPoolProvider node>
  api_source: iam.workloadIdentityPoolProviders.list
  evidence_field: name (workloadIdentityPools/*/providers/*)
  narrative: '{pool.name} contains workload identity pool provider {provider.name}.'