gcp-workflows-passidentity-actas

actAs on a SA that the principal can attach to a workflow (create/update) is the GCP PassRole analog for Workflows.

derived gcp emits CanPassIdentity

match (effective permission)

{ "action": "iam.serviceAccounts.actAs", "resource_type": "google.iam.ServiceAccount" }

where

principal can create or update a workflow (workflows.workflows.create or .update in scope)

emit

source typeIdentity
target typeServiceAccount
source<principal>
target<service account>
permissionsiam.serviceAccounts.actAs
conditionsrole_compatibility iam_permission

Narrative

{principal.name} holds iam.serviceAccounts.actAs on {sa.name} and can bind it as the runtime service account of a workflow it creates or updates.

Raw rule rules/derived/gcp/workflows.yaml

id: gcp-workflows-passidentity-actas
emits: CanPassIdentity
alias_of: gcp-sa-act-as
dedupe_on: edge_id
description: actAs on a SA that the principal can attach to a workflow (create/update) is the GCP PassRole
  analog for Workflows.
match_effective_permission:
  action: iam.serviceAccounts.actAs
  resource_type: google.iam.ServiceAccount
where:
- principal can create or update a workflow (workflows.workflows.create or .update in scope)
emit:
  source_type: Identity
  target_type: ServiceAccount
  source: <principal>
  target: <service account>
  permissions:
  - iam.serviceAccounts.actAs
  derived_from:
  - 'effective permission: iam.serviceAccounts.actAs on the service account'
  conditions:
  - role_compatibility
  - iam_permission
  false_positive_note: "Scoped alias of gcp-sa-act-as \u2014 de-duped on edge_id so no duplicate CanPassIdentity\
    \ edge is produced. actAs is per-SA: actAs on sa-A does NOT allow attaching sa-B. Only emit for SAs\
    \ the principal can actAs; no actAs -> POTENTIAL. Requires the principal also holds workflows.workflows.create\
    \ or .update to actually use the actAs to change a workflow's runtime SA."
  narrative: '{principal.name} holds iam.serviceAccounts.actAs on {sa.name} and can bind it as the runtime
    service account of a workflow it creates or updates.'
move · open · esc close