rage.fail

gcp-workflows-attach-sa-via-update

Update the serviceAccount field to swap the runtime SA of an existing workflow.

derived gcp emits CanAttachIdentity

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanModifyConfiguration {'workflow': None} {'principal': None} CanPassIdentity {'sa': None}

where

node_type(?workflow) == Workflow ?principal has iam.serviceAccounts.actAs on ?sa

emit

source type	`Identity`
target type	`Messaging`
source	`<principal>`
target	`<workflow>`
permissions	`workflows.workflows.update` `iam.serviceAccounts.actAs`

Narrative

{principal.name} can change the runtime SA of {workflow.name} to {sa.name} (workflows.workflows.update + iam.serviceAccounts.actAs).

Raw rule rules/derived/gcp/workflows.yaml

id: gcp-workflows-attach-sa-via-update
emits: CanAttachIdentity
description: Update the serviceAccount field to swap the runtime SA of an existing workflow.
match:
- - principal: null
  - CanModifyConfiguration
  - workflow: null
- - principal: null
  - CanPassIdentity
  - sa: null
where:
- node_type(?workflow) == Workflow
- ?principal has iam.serviceAccounts.actAs on ?sa
emit:
  source_type: Identity
  target_type: Messaging
  source: <principal>
  target: <workflow>
  permissions:
  - workflows.workflows.update
  - iam.serviceAccounts.actAs
  derived_from:
  - ?principal CanModifyConfiguration ?workflow (gcp-workflows-update-config)
  - ?principal CanPassIdentity ?sa (gcp-workflows-passidentity-actas)
  note: Chains to CanExecuteAs(?sa) once a run path exists via can-execute-as.yaml execute-as-via-config-identity-swap.
    This edge records the attach capability itself.
  false_positive_note: Requires actAs on the new SA. The attach is ACTIVE once actAs is confirmed; downstream
    CanExecuteAs still needs a run path (invoke or live trigger).
  narrative: '{principal.name} can change the runtime SA of {workflow.name} to {sa.name} (workflows.workflows.update
    + iam.serviceAccounts.actAs).'