rage.fail

gcp-workload-identity-federation

derived gcp emits CanFederateAs

match (record)

{ "field": "providers[].attributeMapping", "resource_type": "google.iam.WorkloadIdentityPool" }

where

a pool provider maps an external (attacker-controllable) subject to an SA via roles/iam.workloadIdentityUser

emit

source	`<external/federated identity>`
target	`<service account>`
permissions	`roles/iam.workloadIdentityUser (getAccessToken via WIF)`
conditions	`trust_relationship` `condition_expression`

Narrative

{external.name} can federate via the workload identity pool into {sa.name} (WIF).

Raw rule rules/derived/gcp/identity-escalation.yaml

id: gcp-workload-identity-federation
emits: CanFederateAs
match_record:
  resource_type: google.iam.WorkloadIdentityPool
  field: providers[].attributeMapping
where:
- a pool provider maps an external (attacker-controllable) subject to an SA via roles/iam.workloadIdentityUser
emit:
  source: <external/federated identity>
  target: <service account>
  permissions:
  - roles/iam.workloadIdentityUser (getAccessToken via WIF)
  conditions:
  - trust_relationship
  - condition_expression
  false_positive_note: Only ACTIVE if the attribute condition is attacker-satisfiable (broad aud/sub mapping).
  narrative: '{external.name} can federate via the workload identity pool into {sa.name} (WIF).'