CanImpersonate
Source acts as target without holding long-lived creds (GCP SA impersonation, act-on-behalf-of).
Identity
── CanImpersonate ──▸
ServiceAccount, MachineIdentity, ManagedIdentity, WorkloadIdentity, ApplicationIdentity
Source types
IdentityStates
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | both |
|---|
Per-cloud
| cloud | permissions / triggers | note |
|---|---|---|
| aws | - | Rare; usually expressed as CanAssume. |
| gcp |
iam.serviceAccounts.getAccessToken iam.serviceAccounts.implicitDelegation
|
|
| azure | - | App-only token acquisition where app has app-role/consent. |
Rules that emit CanImpersonate 11
Forging a CA-trusted cert lets the principal act as the downstream identity.
awsderived
Signing with a key that anchors an auth system forges the trusted identity.
awsderived
Reading a credential that is credentials for an identity yields the ability to authenticate as that identity.
derived
Reading a secret that is credentials for an identity yields the ability to authenticate as that identity.
derived
Signing tokens as an identity yields impersonation when a downstream trust validates those signatures.
derived
Federating in as an internal Role/ServiceAccount lets the principal act AS it, inheriting its outbound capabilities; rolled up as CanImpersonate.
derived
Issue a cert for an attacker-chosen subject/SAN that a downstream trust accepts, impersonating that identity.
gcpderived
gcpderived
gcpderived
Signing as a key that anchors an identity (JWKS/JWT/code-signing) forges that identity.
gcpderived
Reading a secret whose payload is an SA JSON key yields long-lived credentials for that SA.
gcpderived