cloudforge v1.4.0 GCP Workload Identity · seed 41

brief

# Lab: `gcp_workload_identity_federation`

healthtech / startup / `gcp-analytics-engine` · prod

## Your job

An external CI identity federates into this project. Can it impersonate a service account and read restricted storage?

For each path, name where it starts, what opens the way, and what the attacker reaches. That is not always data: it can be a role, a key, a secret, an image, a queue, a snapshot or a database.

## Resources

- `n16_a524/org-cloud-enterprise`: **GcpOrganization** org-cloud-enterprise-a524
- `n42_a524/prj-analytics-prod`: **GcpProject** prj-analytics-prod-a524
- `n39_a524/pool-github-actions`: **GcpWorkloadIdentityPool** pool-github-actions-a524
- `n43_a524/sa-workload-deployer`: **GcpServiceAccount** sa-workload-deployer-a524
- `n30_a524/bkt-enterprise-analytics`: **GcpStorageBucket** bkt-enterprise-analytics-a524
- `n04_a524/enterprise-analytics`: **DataSet** enterprise-analytics-a524
- `n37_a524/sa-cache-warmer`: **GcpServiceAccount** sa-cache-warmer-a524
- `n01_a524/sa-report-builder`: **GcpServiceAccount** sa-report-builder-a524
- `n19_a524/sa-config-sync`: **GcpServiceAccount** sa-config-sync-a524
- `n45_a524/sa-site-publisher`: **GcpServiceAccount** sa-site-publisher-a524
- `n02_a524/bkt-site-build`: **GcpStorageBucket** bkt-site-build-a524
- `n33_a524/sa-release-audit`: **GcpServiceAccount** sa-release-audit-a524
- `n08_a524/bkt-release-archive`: **GcpStorageBucket** bkt-release-archive-a524
- `n44_a524/bkt-cdn-origin`: **GcpStorageBucket** bkt-cdn-origin-a524
- `n09_a524/bkt-public-docs`: **GcpStorageBucket** bkt-public-docs-a524
- `n31_a524/bkt-ml-features`: **GcpStorageBucket** bkt-ml-features-a524
- `n34_a524/feature-vectors`: **DataSet** feature-vectors-a524
- `n21_a524/bkt-billing-exports`: **GcpStorageBucket** bkt-billing-exports-a524
- `n41_a524/billing-statements`: **DataSet** billing-statements-a524
- `n40_a524/bkt-ml-features`: **GcpStorageBucket** bkt-ml-features-2-a524
- `n25_a524/feature-vectors`: **DataSet** feature-vectors-2-a524
- `n38_a524/pool-vendor-builds`: **GcpWorkloadIdentityPool** pool-vendor-builds-a524
- `n32_a524/pool-vendor-builds`: **GcpWorkloadIdentityPool** pool-vendor-builds-2-a524
- `n07_a524/sa-ci-runner`: **GcpServiceAccount** sa-ci-runner-a524
- `n27_a524/fld-platform`: **GcpFolder** fld-platform-a524
- `n24_a524/sa-lint-worker`: **GcpServiceAccount** sa-lint-worker-a524
- `n03_a524/prj-shared-tools`: **GcpProject** prj-shared-tools-a524
- `n14_a524/pool-partner-ci`: **GcpWorkloadIdentityPool** pool-partner-ci-a524
- `n18_a524/fld-data-eng`: **GcpFolder** fld-data-eng-a524
- `n17_a524/bkt-build-artifacts`: **GcpStorageBucket** bkt-build-artifacts-a524
- `n36_a524/bkt-telemetry-sink`: **GcpStorageBucket** bkt-telemetry-sink-a524
- `n06_a524/telemetry-sink`: **DataSet** telemetry-sink-a524
- `n22_a524/pool-partner-ci`: **GcpWorkloadIdentityPool** pool-partner-ci-2-a524
- `n10_a524/bkt-ci-cache`: **GcpStorageBucket** bkt-ci-cache-a524
- `n46_a524/prj-sandbox-dev`: **GcpProject** prj-sandbox-dev-a524
- `n28_a524/bkt-reporting-store`: **GcpStorageBucket** bkt-reporting-store-a524
- `n00_a524/reporting-store`: **DataSet** reporting-store-a524
- `n26_a524/bkt-ops-metrics`: **GcpStorageBucket** bkt-ops-metrics-a524
- `n12_a524/operational-metrics`: **DataSet** operational-metrics-a524
- `n35_a524/pool-partner-ci`: **GcpWorkloadIdentityPool** pool-partner-ci-3-a524
- `n05_a524/sa-build-agent`: **GcpServiceAccount** sa-build-agent-a524
- `n23_a524/bkt-ops-metrics`: **GcpStorageBucket** bkt-ops-metrics-2-a524
- `n29_a524/operational-metrics`: **DataSet** operational-metrics-2-a524
- `n15_a524/sa-build-agent`: **GcpServiceAccount** sa-build-agent-2-a524
- `n13_a524/pool-partner-ci`: **GcpWorkloadIdentityPool** pool-partner-ci-4-a524
- `n11_a524/pool-vendor-builds`: **GcpWorkloadIdentityPool** pool-vendor-builds-3-a524
- `n20_a524/fld-partners`: **GcpFolder** fld-partners-a524

## Relationships

- `n16_a524/org-cloud-enterprise` --organizational_child--> `n42_a524/prj-analytics-prod`
- `n42_a524/prj-analytics-prod` --organizational_child--> `n39_a524/pool-github-actions`
- `n39_a524/pool-github-actions` --federates_to--> `n43_a524/sa-workload-deployer`
- `n43_a524/sa-workload-deployer` --impersonates--> `n37_a524/sa-cache-warmer`
- `n37_a524/sa-cache-warmer` --impersonates--> `n01_a524/sa-report-builder`
- `n01_a524/sa-report-builder` --impersonates--> `n19_a524/sa-config-sync`
- `n19_a524/sa-config-sync` --can_read--> `n30_a524/bkt-enterprise-analytics`
- `n30_a524/bkt-enterprise-analytics` --stores_sensitive_data--> `n04_a524/enterprise-analytics`
- `n39_a524/pool-github-actions` --federates_to--> `n45_a524/sa-site-publisher`
- `n45_a524/sa-site-publisher` --can_read--> `n02_a524/bkt-site-build`
- `n33_a524/sa-release-audit` --can_read--> `n08_a524/bkt-release-archive`
- `n31_a524/bkt-ml-features` --stores_sensitive_data--> `n34_a524/feature-vectors`
- `n21_a524/bkt-billing-exports` --stores_sensitive_data--> `n41_a524/billing-statements`
- `n40_a524/bkt-ml-features` --stores_sensitive_data--> `n25_a524/feature-vectors`
- `n36_a524/bkt-telemetry-sink` --stores_sensitive_data--> `n06_a524/telemetry-sink`
- `n28_a524/bkt-reporting-store` --stores_sensitive_data--> `n00_a524/reporting-store`
- `n26_a524/bkt-ops-metrics` --stores_sensitive_data--> `n12_a524/operational-metrics`
- `n23_a524/bkt-ops-metrics` --stores_sensitive_data--> `n29_a524/operational-metrics`

how this works

This estate was prebaked. A unique copy composes on the server in about 20 ms from a scenario spec: 10,000 seeds per family, 15 families. No cloud account was touched; the graph is the source of truth.

The grade is one call to TypeSafe Jev: three yes/no questions (entry, hop, sink) and one depth score (0 to 3, fewer rungs on a short path), typed probabilities back. No grade yet on this page.