ServiceIdentity
Identity a managed service runs as / on behalf of.
class: Identity derivation-only - no collection recipe
Realizing resources
This type has no collection recipe - it appears only as the endpoint of derived edges.
As edge source
AuthenticatesToCanAddMemberCanAdministerCanAssumeCanAttachIdentityCanControlCanCreateCanCreateCredentialForCanCreateKeyCanCreateWorkloadAsCanDecryptCanDelegateCanDeleteCanDeleteDataCanDeployCanEnterAccountCanEnterOrganizationCanEnterProjectCanEnterSubscriptionCanEnterTenantCanEscalateToCanExecuteAsCanExecuteCommandCanExecuteOnCanExfiltrateCanExportKeyCanFederateAsCanGrantPermissionCanImpersonateCanInvokeCanModifyCanModifyCodeCanModifyConfigurationCanModifyPolicyCanModifyTrustCanNetworkReachCanPassIdentityCanReadCanReadCredentialCanReadDataCanReadSecretCanRemoveMemberCanReplaceCanResetCredentialCanRetrieveTokenCanScheduleCanSignAsCanStartCanTakeOwnershipCanTriggerCanWriteCanWriteDataControlsExposedToAccountExposedToTenantFederatesToHasPermissionHasPolicyHasRoleLocatedInMemberOfAs edge target
AttachedToAuthenticatesToCanAddMemberCanAdministerCanControlCanCreateCanCreateCredentialForCanCreateWorkloadAsCanDelegateCanDeleteCanEscalateToCanExecuteAsCanGrantPermissionCanModifyCanModifyConfigurationCanModifyPolicyCanReadCanReplaceCanResetCredentialCanRetrieveTokenCanTakeOwnershipCanWriteContainsContainsResourceReferenceControlsCredentialValidForCredentialsForExecutesAsExposesCredentialExternalIdentityMapsToFederatesToHasPermissionExposure sites
aws-acm-exported-private-key-outputaws-amplify-webhook-url-outputaws-apigateway-rest-api-key-valueaws-cloudformation-stack-output-valueaws-cloudhsm-extractable-key-material-data-planeaws-codeartifact-authorization-token-outputaws-codebuild-exported-environment-variable-outputaws-codebuild-webhook-secret-output
Rules that touch ServiceIdentity 11
An IAM principal with cognito-identity:GetOpenIdTokenForDeveloperIdentity can synthesize a developer-authenticated token for any developerUserId in the pool and exchange it for the authenticated role's IAM credentials, bypassing user authentication entirely.
aws
CanFederateAsArbitrary container deployment runs as the Lightsail-managed service execution context.
aws
CanExecuteAsAn Amazon MQ broker exposes the wire-protocol credentials of its broker users; these are modeled as Credential nodes and grant data-plane publish/consume access.
An Automation Account sandbox job executes as the bound managed identity; any code running in the sandbox can mint MI tokens from IMDS.
azure
ExecutesAsAn Automation Account sandbox job exposes its bound MI's token to any code it runs via the IMDS endpoint.
azure
ExposesCredentialA cluster with a bound Access Connector MI leaks that MI's credential to any code running on it via IMDS.
azure
ExposesCredentialAny code on a cluster with a bound MI can mint a bearer token for that MI via IMDS.
azure
CanRetrieveTokenAn Azure Policy remediation task (modeled as BuildWorker - the ARM deployment runner) executes as the managed identity bound in the policy assignment's identity block. Zero-cost structural fact; can-execute-as execute-as-via-code-modify and cicd-chains cicd-modify-buildspec-executes-as consume this to produce CanExecuteAs.
azure
ExecutesAsExec into a pod (cluster RBAC / credential / run-command) inherits the pod's mounted ServiceAccount/IRSA/Workload-Identity token, executing as that identity.
A cert signed by the CA authenticates as the subject/SAN it names to a consuming trust.
gcp
CredentialsFor