# Lab: `gcp_workload_identity_federation` healthtech / startup / `gcp-analytics-engine` · prod ## Your job An external CI identity federates into this project. Can it impersonate a service account and read restricted storage? For each path, name where it starts, what opens the way, and what the attacker reaches. That is not always data: it can be a role, a key, a secret, an image, a queue, a snapshot or a database. ## Resources - `n33_82c1/org-cloud-enterprise`: **GcpOrganization** org-cloud-enterprise-82c1 - `n43_82c1/prj-analytics-prod`: **GcpProject** prj-analytics-prod-82c1 - `n18_82c1/pool-github-actions`: **GcpWorkloadIdentityPool** pool-github-actions-82c1 - `n27_82c1/sa-workload-deployer`: **GcpServiceAccount** sa-workload-deployer-82c1 - `n03_82c1/bkt-enterprise-analytics`: **GcpStorageBucket** bkt-enterprise-analytics-82c1 - `n07_82c1/enterprise-analytics`: **DataSet** enterprise-analytics-82c1 - `n00_82c1/sa-migration-helper`: **GcpServiceAccount** sa-migration-helper-82c1 - `n08_82c1/bkt-migration-staging`: **GcpStorageBucket** bkt-migration-staging-82c1 - `n05_82c1/bkt-cdn-origin`: **GcpStorageBucket** bkt-cdn-origin-82c1 - `n06_82c1/bkt-open-data`: **GcpStorageBucket** bkt-open-data-82c1 - `n46_82c1/bkt-partner-uploads`: **GcpStorageBucket** bkt-partner-uploads-82c1 - `n10_82c1/partner-upload-files`: **DataSet** partner-upload-files-82c1 - `n17_82c1/bkt-billing-exports`: **GcpStorageBucket** bkt-billing-exports-82c1 - `n02_82c1/billing-statements`: **DataSet** billing-statements-82c1 - `n21_82c1/sa-ci-runner`: **GcpServiceAccount** sa-ci-runner-82c1 - `n30_82c1/pool-vendor-builds`: **GcpWorkloadIdentityPool** pool-vendor-builds-82c1 - `n28_82c1/pool-bitbucket-ci`: **GcpWorkloadIdentityPool** pool-bitbucket-ci-82c1 - `n13_82c1/pool-vendor-builds`: **GcpWorkloadIdentityPool** pool-vendor-builds-2-82c1 - `n26_82c1/bkt-docker-layers`: **GcpStorageBucket** bkt-docker-layers-82c1 - `n04_82c1/prj-sandbox-dev`: **GcpProject** prj-sandbox-dev-82c1 - `n14_82c1/fld-partners`: **GcpFolder** fld-partners-82c1 - `n24_82c1/prj-shared-tools`: **GcpProject** prj-shared-tools-82c1 - `n39_82c1/fld-platform`: **GcpFolder** fld-platform-82c1 - `n19_82c1/bkt-ci-cache`: **GcpStorageBucket** bkt-ci-cache-82c1 - `n32_82c1/fld-partners`: **GcpFolder** fld-partners-2-82c1 - `n44_82c1/prj-network-hub`: **GcpProject** prj-network-hub-82c1 - `n40_82c1/fld-platform`: **GcpFolder** fld-platform-2-82c1 - `n01_82c1/sa-ci-runner`: **GcpServiceAccount** sa-ci-runner-2-82c1 - `n34_82c1/fld-platform`: **GcpFolder** fld-platform-3-82c1 - `n38_82c1/fld-partners`: **GcpFolder** fld-partners-3-82c1 - `n35_82c1/prj-monitoring`: **GcpProject** prj-monitoring-82c1 - `n12_82c1/prj-sandbox-dev`: **GcpProject** prj-sandbox-dev-2-82c1 - `n15_82c1/bkt-analytics-cache`: **GcpStorageBucket** bkt-analytics-cache-82c1 - `n29_82c1/analytics-cache`: **DataSet** analytics-cache-82c1 - `n36_82c1/bkt-release-images`: **GcpStorageBucket** bkt-release-images-82c1 - `n09_82c1/bkt-build-artifacts`: **GcpStorageBucket** bkt-build-artifacts-82c1 - `n31_82c1/bkt-test-reports`: **GcpStorageBucket** bkt-test-reports-82c1 - `n37_82c1/prj-ci-builders`: **GcpProject** prj-ci-builders-82c1 - `n45_82c1/bkt-analytics-cache`: **GcpStorageBucket** bkt-analytics-cache-2-82c1 - `n16_82c1/analytics-cache`: **DataSet** analytics-cache-2-82c1 - `n22_82c1/bkt-docker-layers`: **GcpStorageBucket** bkt-docker-layers-2-82c1 - `n41_82c1/bkt-telemetry-sink`: **GcpStorageBucket** bkt-telemetry-sink-82c1 - `n20_82c1/telemetry-sink`: **DataSet** telemetry-sink-82c1 - `n42_82c1/fld-sandboxes`: **GcpFolder** fld-sandboxes-82c1 - `n25_82c1/prj-shared-tools`: **GcpProject** prj-shared-tools-2-82c1 - `n11_82c1/bkt-media-cache`: **GcpStorageBucket** bkt-media-cache-82c1 - `n23_82c1/media-cache`: **DataSet** media-cache-82c1 ## Relationships - `n33_82c1/org-cloud-enterprise` --organizational_child--> `n43_82c1/prj-analytics-prod` - `n43_82c1/prj-analytics-prod` --organizational_child--> `n18_82c1/pool-github-actions` - `n18_82c1/pool-github-actions` --federates_to--> `n27_82c1/sa-workload-deployer` - `n27_82c1/sa-workload-deployer` --can_read--> `n03_82c1/bkt-enterprise-analytics` - `n03_82c1/bkt-enterprise-analytics` --stores_sensitive_data--> `n07_82c1/enterprise-analytics` - `n00_82c1/sa-migration-helper` --can_read--> `n08_82c1/bkt-migration-staging` - `n46_82c1/bkt-partner-uploads` --stores_sensitive_data--> `n10_82c1/partner-upload-files` - `n17_82c1/bkt-billing-exports` --stores_sensitive_data--> `n02_82c1/billing-statements` - `n15_82c1/bkt-analytics-cache` --stores_sensitive_data--> `n29_82c1/analytics-cache` - `n45_82c1/bkt-analytics-cache` --stores_sensitive_data--> `n16_82c1/analytics-cache` - `n41_82c1/bkt-telemetry-sink` --stores_sensitive_data--> `n20_82c1/telemetry-sink` - `n11_82c1/bkt-media-cache` --stores_sensitive_data--> `n23_82c1/media-cache`
This estate was prebaked. A unique copy composes on the server in about 20 ms from a scenario spec: 10,000 seeds per family, 15 families. No cloud account was touched; the graph is the source of truth.
The grade is one call to TypeSafe Jev: three yes/no questions (entry, hop, sink) and one depth score (0 to 3, fewer rungs on a short path), typed probabilities back. No grade yet on this page.
cloudforge on GitHub