🧠 Google IAM Service Account has admin privileges - prod.logic.yaml 🟢

• Contextual name: 🧠 prod.logic.yaml 🟢
• ID: /ce/ca/google/iam/service-account-admin-privileges/prod.logic.yaml
• Located in: 📝 Google IAM Service Account has admin privileges 🟢

Flags

• 🟢 Logic test success
• 🟢 Logic with extracts
• 🟢 Logic with test data

Input Type

	Type	API Name	Extracts	Extract Files	Logic Files
🔒	📕 Google IAM Service Account	CA10__CaGoogleIamServiceAccount__c	3	1	2

Uses

• 🔌 Google IAM Service Account - object.extracts.yaml
• 🔌 Google IAM Policy Binding - object.extracts.yaml
• 🔌 Google IAM Role - object.extracts.yaml
• 🧪 test-data.json

Test Results 🟢

Generated at: 2025-04-24T23:47:02.138644456Z Open

Result	Id	Condition Index	Condition Text	Runtime Error
🟢	aAL1	✔️ 199	✔️ not(extract('CA10__serviceAccountEmail__c').endsWith('.iam.gserviceaccount.com') && extract('CA10__serviceAccountEmail__c').contains(extract('serviceAccountProjectId')))	✔️ null
🟢	aAL2	✔️ 299	✔️ CA10__Google_IAM_Policy_Bindings__r.has(INCOMPLIANT)	✔️ null
🟢	aAL3	✔️ 300	✔️ otherwise	✔️ null

Generation

	File	MD5
Open	/ce/ca/google/iam/service-account-admin-privileges/policy.yaml	7E0EF4EA0B75604F014743FA092787BB
Open	/ce/ca/google/iam/service-account-admin-privileges/prod.logic.yaml	BCC2C76931FDDEB068C9B8C8BCE09957
Open	/ce/ca/google/iam/service-account-admin-privileges/test-data.json	ACA19B77F93426BBAD39F75BEC16899B
Open	/types/CA10__CaGoogleIamServiceAccount__c/object.extracts.yaml	EB5FB013DE89FCA54D6B42804FC725D6
Open	/types/CA10__CaGoogleIamPolicyBinding__c/object.extracts.yaml	DA65DB880E2440923287921FF4E70B30
Open	/types/CA10__CaGoogleIamRole__c/object.extracts.yaml	545CD4D347F041DCDD9980D122D63882

Generate FULL script

java -jar repo-manager.jar policies generate FULL /ce/ca/google/iam/service-account-admin-privileges/prod.logic.yaml

Generate DEBUG script

java -jar repo-manager.jar policies generate DEBUG /ce/ca/google/iam/service-account-admin-privileges/prod.logic.yaml

Generate CAPTURE_TEST_DATA script

java -jar repo-manager.jar policies generate CAPTURE_TEST_DATA /ce/ca/google/iam/service-account-admin-privileges/prod.logic.yaml

Generate TESTS script

java -jar repo-manager.jar policies generate TESTS /ce/ca/google/iam/service-account-admin-privileges/prod.logic.yaml

Execute tests

java -jar repo-manager.jar policies test /ce/ca/google/iam/service-account-admin-privileges/prod.logic.yaml

Content

Open File

---
inputType: "CA10__CaGoogleIamServiceAccount__c"
testData:
  - file: test-data.json
importExtracts:
  - file: /types/CA10__CaGoogleIamServiceAccount__c/object.extracts.yaml
conditions: 
  - status: "INAPPLICABLE"
    currentStateMessage: "This recommendation is only applicable to User-Managed user-created service accounts."
    check:
## NOT: SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com
      NOT:
        arg:
          AND:
            args:
              - ENDS_WITH:
                  arg:
                    EXTRACT: CA10__serviceAccountEmail__c
                  suffix:
                    TEXT: ".iam.gserviceaccount.com" 
              - CONTAINS:
                  arg:
                    EXTRACT: CA10__serviceAccountEmail__c
                  substring:
                    EXTRACT: serviceAccountProjectId
  - status: "INCOMPLIANT"
    currentStateMessage: "This Service Account has roles with admin privileges."
    remediationMessage: "Consider restricting the Service Account."
    check:
      RELATED_LIST_HAS:
        status: "INCOMPLIANT"
        relationshipName: "CA10__Google_IAM_Policy_Bindings__r"
otherwise:
  status: "COMPLIANT"
  currentStateMessage: "The Service Account has no admin privileges "
relatedLists:
  - relationshipName: "CA10__Google_IAM_Policy_Bindings__r"
    importExtracts:
      - file: /types/CA10__CaGoogleIamPolicyBinding__c/object.extracts.yaml
      - file: /types/CA10__CaGoogleIamRole__c/object.extracts.yaml
    recordTypes:
      - "caGoogleIamPolicyBindingProject"
    conditions:
      - status: "COMPLIANT"
        currentStateMessage: "There is no role with admin privileges"
        check:
          IS_EMPTY_LOOKUP: "CA10__iamRole__r"
      - status: "INCOMPLIANT"
        currentStateMessage: "Role with admin privileges"
        check:
           OR:
             args:
               - CONTAINS:
                   arg:
                     EXTRACT: "CA10__iamRole__r.CA10__roleName__c"
                   substring:
                     TEXT: "admin"
               - IS_EQUAL:
                   left:
                     EXTRACT: "CA10__iamRole__r.CA10__roleName__c"
                   right:
                     TEXT: "editor"
               - IS_EQUAL:
                   left:
                     EXTRACT: "CA10__iamRole__r.CA10__roleName__c"
                   right:
                     TEXT: "owner"
    otherwise:
      status: "COMPLIANT"
      currentStateMessage: "Role without admin privileges"