gcp-workflows-update-config
workflows.workflows.update can also re-point the runtime SA (serviceAccount field) when paired with actAs; configuration change path to CanExecuteAs.
match (effective permission)
{
"action": "workflows.workflows.update",
"resource_type": "google.workflows.type.Workflow"
}
emit
| source type | Identity |
|---|---|
| target type | Messaging |
| source | <principal> |
| target | <workflow in scope> |
| permissions | workflows.workflows.update |
Narrative
{principal.name} can update the configuration of {workflow.name} (workflows.workflows.update), including re-pointing the runtime service account (requires iam.serviceAccounts.actAs on the new SA).
Raw rule rules/derived/gcp/workflows.yaml
id: gcp-workflows-update-config
emits: CanModifyConfiguration
description: workflows.workflows.update can also re-point the runtime SA (serviceAccount field) when paired
with actAs; configuration change path to CanExecuteAs.
match_effective_permission:
action: workflows.workflows.update
resource_type: google.workflows.type.Workflow
emit:
source_type: Identity
target_type: Messaging
source: <principal>
target: <workflow in scope>
permissions:
- workflows.workflows.update
derived_from:
- 'effective permission: workflows.workflows.update on the workflow resource'
note: Re-pointing serviceAccount additionally requires iam.serviceAccounts.actAs on the new SA. This
rule emits the configuration-change capability; the actAs requirement is enforced by the CanPassIdentity
edge (gcp-workflows-passidentity-actas). Both CanModifyCode and CanModifyConfiguration are produced
from the same permission; graph builder deduplicates via edge_id.
false_positive_note: "Same trigger gating as the code-update path (CONDITIONAL without execution path).\
\ Changing the serviceAccount field without actAs on the new SA fails at the API level \u2014 always\
\ require the CanPassIdentity gate before asserting config-identity-swap escalation."
narrative: '{principal.name} can update the configuration of {workflow.name} (workflows.workflows.update),
including re-pointing the runtime service account (requires iam.serviceAccounts.actAs on the new SA).'