gcp-workflows-passidentity-actas
actAs on a SA that the principal can attach to a workflow (create/update) is the GCP PassRole analog for Workflows.
match (effective permission)
{
"action": "iam.serviceAccounts.actAs",
"resource_type": "google.iam.ServiceAccount"
}
where
principal can create or update a workflow (workflows.workflows.create or .update in scope)
emit
| source type | Identity |
|---|---|
| target type | ServiceAccount |
| source | <principal> |
| target | <service account> |
| permissions | iam.serviceAccounts.actAs |
| conditions | role_compatibility iam_permission |
Narrative
{principal.name} holds iam.serviceAccounts.actAs on {sa.name} and can bind it as the runtime service account of a workflow it creates or updates.
Raw rule rules/derived/gcp/workflows.yaml
id: gcp-workflows-passidentity-actas
emits: CanPassIdentity
alias_of: gcp-sa-act-as
dedupe_on: edge_id
description: actAs on a SA that the principal can attach to a workflow (create/update) is the GCP PassRole
analog for Workflows.
match_effective_permission:
action: iam.serviceAccounts.actAs
resource_type: google.iam.ServiceAccount
where:
- principal can create or update a workflow (workflows.workflows.create or .update in scope)
emit:
source_type: Identity
target_type: ServiceAccount
source: <principal>
target: <service account>
permissions:
- iam.serviceAccounts.actAs
derived_from:
- 'effective permission: iam.serviceAccounts.actAs on the service account'
conditions:
- role_compatibility
- iam_permission
false_positive_note: "Scoped alias of gcp-sa-act-as \u2014 de-duped on edge_id so no duplicate CanPassIdentity\
\ edge is produced. actAs is per-SA: actAs on sa-A does NOT allow attaching sa-B. Only emit for SAs\
\ the principal can actAs; no actAs -> POTENTIAL. Requires the principal also holds workflows.workflows.create\
\ or .update to actually use the actAs to change a workflow's runtime SA."
narrative: '{principal.name} holds iam.serviceAccounts.actAs on {sa.name} and can bind it as the runtime
service account of a workflow it creates or updates.'