---
inputType: "CA10__CaGoogleIamServiceAccount__c"
testData:
  - file: test-data.json
importExtracts:
  - file: /types/CA10__CaGoogleIamServiceAccount__c/object.extracts.yaml
conditions: 
  - status: "INAPPLICABLE"
    currentStateMessage: "This recommendation applies only to user-managed service accounts."
    check:
## NOT: SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com
      NOT:
        arg:
          AND:
            args:
              - ENDS_WITH:
                  arg:
                    EXTRACT: CA10__serviceAccountEmail__c
                  search:
                    TEXT: ".iam.gserviceaccount.com" 
              - CONTAINS:
                  arg:
                    EXTRACT: CA10__serviceAccountEmail__c
                  search:
                    EXTRACT: serviceAccountProjectId
  - status: "INCOMPLIANT"
    currentStateMessage: "This service account has roles with admin privileges."
    remediationMessage: "Restrict the service account privileges."
    check:
      RELATED_LIST_HAS:
        status: "INCOMPLIANT"
        relationshipName: "CA10__Google_IAM_Policy_Bindings__r"
otherwise:
  status: "COMPLIANT"
  currentStateMessage: "The service account has no admin privileges."
relatedLists:
  - relationshipName: "CA10__Google_IAM_Policy_Bindings__r"
    importExtracts:
      - file: /types/CA10__CaGoogleIamPolicyBinding__c/object.extracts.yaml
      - file: /types/CA10__CaGoogleIamRole__c/object.extracts.yaml
    recordTypes:
      - "caGoogleIamPolicyBindingProject"
    conditions:
      - status: "COMPLIANT"
        currentStateMessage: "There is no role with admin privileges."
        check:
          IS_EMPTY_LOOKUP: "CA10__iamRole__r"
      - status: "INCOMPLIANT"
        currentStateMessage: "Role with admin privileges."
        check:
           OR:
             args:
               - CONTAINS:
                   arg:
                     EXTRACT: "CA10__iamRole__r.CA10__roleName__c"
                   search:
                     TEXT: "admin"
               - IS_EQUAL:
                   left:
                     EXTRACT: "CA10__iamRole__r.CA10__roleName__c"
                   right:
                     TEXT: "editor"
               - IS_EQUAL:
                   left:
                     EXTRACT: "CA10__iamRole__r.CA10__roleName__c"
                   right:
                     TEXT: "owner"
    otherwise:
      status: "COMPLIANT"
      currentStateMessage: "Role without admin privileges."