🧠 Google IAM Service Account has admin privileges - prod.logic.yaml🟢

• Contextual name: 🧠 prod.logic.yaml🟢
• ID: /ce/ca/google/iam/service-account-admin-privileges/prod.logic.yaml
• Tags:
  • 🟢 Logic test success
  • 🟢 Logic with extracts
  • 🟢 Logic with test data

Uses

• 📗 Google IAM Service Account
• 🔌 Google IAM Role - object.extracts.yaml
• 🔌 Google IAM Policy Binding - object.extracts.yaml
• 🔌 Google IAM Service Account - object.extracts.yaml
• 🧪 test-data.json

Test Results 🟢

Generated at: 2026-06-06T12:04:29.740349123Z Open

Result	Id	Condition Index	Condition Text	Runtime Error
🟢	aAL1	✔️ 199	✔️ not(extract('CA10__serviceAccountEmail__c').endsWith('.iam.gserviceaccount.com') && extract('CA10__serviceAccountEmail__c').contains(extract('serviceAccountProjectId')))	✔️ null
🟢	aAL2	✔️ 299	✔️ CA10__Google_IAM_Policy_Bindings__r.has(INCOMPLIANT)	✔️ null
🟢	aAL3	✔️ 300	✔️ otherwise	✔️ null

Generation Bundle

	File	MD5
Open	/ce/ca/google/iam/service-account-admin-privileges/policy.yaml	78D01A71F480FA1A124AFBBF58441868
Open	/ce/ca/google/iam/service-account-admin-privileges/prod.logic.yaml	5A13476E27B21F7E90ED1E852134F14A
Open	/ce/ca/google/iam/service-account-admin-privileges/test-data.json	ACA19B77F93426BBAD39F75BEC16899B
Open	/types/CA10__CaGoogleIamRole__c/object.extracts.yaml	545CD4D347F041DCDD9980D122D63882
Open	/types/CA10__CaGoogleIamPolicyBinding__c/object.extracts.yaml	DA65DB880E2440923287921FF4E70B30
Open	/types/CA10__CaGoogleIamServiceAccount__c/object.extracts.yaml	EB5FB013DE89FCA54D6B42804FC725D6

Available Commands

repo-manager policies generate FULL /ce/ca/google/iam/service-account-admin-privileges/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/google/iam/service-account-admin-privileges/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/google/iam/service-account-admin-privileges/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/google/iam/service-account-admin-privileges/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/google/iam/service-account-admin-privileges/prod.logic.yaml

Content

Open File

---
inputType: "CA10__CaGoogleIamServiceAccount__c"
testData:
  - file: test-data.json
importExtracts:
  - file: /types/CA10__CaGoogleIamServiceAccount__c/object.extracts.yaml
conditions: 
  - status: "INAPPLICABLE"
    currentStateMessage: "This recommendation applies only to user-managed service accounts."
    check:
## NOT: SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com
      NOT:
        arg:
          AND:
            args:
              - ENDS_WITH:
                  arg:
                    EXTRACT: CA10__serviceAccountEmail__c
                  search:
                    TEXT: ".iam.gserviceaccount.com" 
              - CONTAINS:
                  arg:
                    EXTRACT: CA10__serviceAccountEmail__c
                  search:
                    EXTRACT: serviceAccountProjectId
  - status: "INCOMPLIANT"
    currentStateMessage: "This service account has roles with admin privileges."
    remediationMessage: "Restrict the service account privileges."
    check:
      RELATED_LIST_HAS:
        status: "INCOMPLIANT"
        relationshipName: "CA10__Google_IAM_Policy_Bindings__r"
otherwise:
  status: "COMPLIANT"
  currentStateMessage: "The service account has no admin privileges."
relatedLists:
  - relationshipName: "CA10__Google_IAM_Policy_Bindings__r"
    importExtracts:
      - file: /types/CA10__CaGoogleIamPolicyBinding__c/object.extracts.yaml
      - file: /types/CA10__CaGoogleIamRole__c/object.extracts.yaml
    recordTypes:
      - "caGoogleIamPolicyBindingProject"
    conditions:
      - status: "COMPLIANT"
        currentStateMessage: "There is no role with admin privileges."
        check:
          IS_EMPTY_LOOKUP: "CA10__iamRole__r"
      - status: "INCOMPLIANT"
        currentStateMessage: "Role with admin privileges."
        check:
           OR:
             args:
               - CONTAINS:
                   arg:
                     EXTRACT: "CA10__iamRole__r.CA10__roleName__c"
                   search:
                     TEXT: "admin"
               - IS_EQUAL:
                   left:
                     EXTRACT: "CA10__iamRole__r.CA10__roleName__c"
                   right:
                     TEXT: "editor"
               - IS_EQUAL:
                   left:
                     EXTRACT: "CA10__iamRole__r.CA10__roleName__c"
                   right:
                     TEXT: "owner"
    otherwise:
      status: "COMPLIANT"
      currentStateMessage: "Role without admin privileges."