brief

# Lab: `gcp_workload_identity_federation`

healthtech / startup / `gcp-analytics-engine` · prod

## Your job

An external CI identity federates into this project. Can it impersonate a service account and read restricted storage?

For each path, name where it starts, what opens the way, and what the attacker reaches. That is not always data: it can be a role, a key, a secret, an image, a queue, a snapshot or a database.

## Resources

- `n22_7994/org-cloud-enterprise`: **GcpOrganization** org-cloud-enterprise-7994
- `n05_7994/prj-analytics-prod`: **GcpProject** prj-analytics-prod-7994
- `n21_7994/pool-github-actions`: **GcpWorkloadIdentityPool** pool-github-actions-7994
- `n02_7994/sa-workload-deployer`: **GcpServiceAccount** sa-workload-deployer-7994
- `n24_7994/bkt-enterprise-analytics`: **GcpStorageBucket** bkt-enterprise-analytics-7994
- `n07_7994/enterprise-analytics`: **DataSet** enterprise-analytics-7994
- `n04_7994/sa-site-publisher`: **GcpServiceAccount** sa-site-publisher-7994
- `n25_7994/bkt-site-build`: **GcpStorageBucket** bkt-site-build-7994
- `n00_7994/sa-partner-sync`: **GcpServiceAccount** sa-partner-sync-7994
- `n17_7994/bkt-partner-inbox`: **GcpStorageBucket** bkt-partner-inbox-7994
- `n18_7994/sa-release-audit`: **GcpServiceAccount** sa-release-audit-7994
- `n20_7994/bkt-release-archive`: **GcpStorageBucket** bkt-release-archive-7994
- `n26_7994/bkt-public-docs`: **GcpStorageBucket** bkt-public-docs-7994
- `n16_7994/bkt-ops-runbooks`: **GcpStorageBucket** bkt-ops-runbooks-7994
- `n11_7994/runbook-library`: **DataSet** runbook-library-7994
- `n10_7994/bkt-audit-evidence`: **GcpStorageBucket** bkt-audit-evidence-7994
- `n12_7994/audit-evidence-files`: **DataSet** audit-evidence-files-7994
- `n23_7994/bkt-billing-exports`: **GcpStorageBucket** bkt-billing-exports-7994
- `n09_7994/billing-statements`: **DataSet** billing-statements-7994
- `n01_7994/pool-bitbucket-ci`: **GcpWorkloadIdentityPool** pool-bitbucket-ci-7994
- `n19_7994/pool-tfc-runs`: **GcpWorkloadIdentityPool** pool-tfc-runs-7994
- `n06_7994/bkt-media-cache`: **GcpStorageBucket** bkt-media-cache-7994
- `n15_7994/media-cache`: **DataSet** media-cache-7994
- `n14_7994/bkt-build-artifacts`: **GcpStorageBucket** bkt-build-artifacts-7994
- `n08_7994/fld-sandboxes`: **GcpFolder** fld-sandboxes-7994
- `n13_7994/bkt-reporting-store`: **GcpStorageBucket** bkt-reporting-store-7994
- `n03_7994/reporting-store`: **DataSet** reporting-store-7994

## Relationships

- `n22_7994/org-cloud-enterprise` --organizational_child--> `n05_7994/prj-analytics-prod`
- `n05_7994/prj-analytics-prod` --organizational_child--> `n21_7994/pool-github-actions`
- `n21_7994/pool-github-actions` --federates_to--> `n02_7994/sa-workload-deployer`
- `n02_7994/sa-workload-deployer` --can_read--> `n24_7994/bkt-enterprise-analytics`
- `n24_7994/bkt-enterprise-analytics` --stores_sensitive_data--> `n07_7994/enterprise-analytics`
- `n21_7994/pool-github-actions` --federates_to--> `n04_7994/sa-site-publisher`
- `n04_7994/sa-site-publisher` --can_read--> `n25_7994/bkt-site-build`
- `n00_7994/sa-partner-sync` --can_read--> `n17_7994/bkt-partner-inbox`
- `n18_7994/sa-release-audit` --can_read--> `n20_7994/bkt-release-archive`
- `n16_7994/bkt-ops-runbooks` --stores_sensitive_data--> `n11_7994/runbook-library`
- `n10_7994/bkt-audit-evidence` --stores_sensitive_data--> `n12_7994/audit-evidence-files`
- `n23_7994/bkt-billing-exports` --stores_sensitive_data--> `n09_7994/billing-statements`
- `n06_7994/bkt-media-cache` --stores_sensitive_data--> `n15_7994/media-cache`
- `n13_7994/bkt-reporting-store` --stores_sensitive_data--> `n03_7994/reporting-store`

how this works

This estate was prebaked. A unique copy composes on the server in about 20 ms from a scenario spec: 10,000 seeds per family, 15 families. No cloud account was touched; the graph is the source of truth.

The grade is one call to TypeSafe Jev: three yes/no questions (entry, hop, sink) and one depth score (0 to 3, fewer rungs on a short path), typed probabilities back. No grade yet on this page.

cloudforge on GitHub