gcp-wif-provider-trusts-external

id: gcp-wif-provider-trusts-external
emits: TrustsExternalIdentity
applies_to:
- gcp
match_record:
  resource_type: iam.WorkloadIdentityPoolProvider
  field: oidc.issuerUri | saml.idpMetadataXml | aws.accountId
emit:
  source_type: ServiceAccount
  target_type: ExternalIdentity
  source: <impersonated ServiceAccount (or the pool provider as ResourcePolicy anchor if no SA binding)>
  target: '<ExternalIdentity: subjects from the pinned issuer>'
  api_source: iam.workloadIdentityPoolProviders.get
  evidence_field: oidc.issuerUri / oidc.allowedAudiences / attributeMapping / attributeCondition / saml.idpMetadataXml
    / aws.accountId
  properties:
    issuer: <oidc.issuerUri | SAML entityID | aws.accountId>
    allowed_audiences: <oidc.allowedAudiences (empty => aud must == provider resource URL)>
    audience_pinned: <true unless allowedAudiences accepts an attacker-mintable value>
    attribute_mapping: <google.subject / attribute.* CEL expressions>
    attribute_condition: <attributeCondition CEL, or null>
    subject_pinned: <true if attributeCondition/mapping bind a specific subject; false if broad/absent>
  false_positive_note: "Empty allowedAudiences is a PIN (aud == provider resource URL), not a wildcard\
    \ \u2014 set audience_pinned=true. A provider in state DISABLED/DELETED trusts nothing \u2014 do not\
    \ emit (or emit BLOCKED). The subject_pinned property must reflect BOTH the attributeCondition AND\
    \ the breadth of the workloadIdentityUser member (see the ExternalIdentityMapsTo rule) \u2014 a broad\
    \ mapping re-pinned by a strict attributeCondition is subject_pinned=true."
  narrative: '{sa.name} (via WIF provider {provider.name}) trusts external identities from issuer {issuer}
    under condition {attribute_condition}.'