# Lab: `gcp_workload_identity_federation` healthtech / startup / `gcp-analytics-engine` · prod ## Your job An external CI identity federates into this project. Can it impersonate a service account and read restricted storage? For each path, name where it starts, what opens the way, and what the attacker reaches. That is not always data: it can be a role, a key, a secret, an image, a queue, a snapshot or a database. ## Resources - `n16_a524/org-cloud-enterprise`: **GcpOrganization** org-cloud-enterprise-a524 - `n42_a524/prj-analytics-prod`: **GcpProject** prj-analytics-prod-a524 - `n39_a524/pool-github-actions`: **GcpWorkloadIdentityPool** pool-github-actions-a524 - `n43_a524/sa-workload-deployer`: **GcpServiceAccount** sa-workload-deployer-a524 - `n30_a524/bkt-enterprise-analytics`: **GcpStorageBucket** bkt-enterprise-analytics-a524 - `n04_a524/enterprise-analytics`: **DataSet** enterprise-analytics-a524 - `n37_a524/sa-cache-warmer`: **GcpServiceAccount** sa-cache-warmer-a524 - `n01_a524/sa-report-builder`: **GcpServiceAccount** sa-report-builder-a524 - `n19_a524/sa-config-sync`: **GcpServiceAccount** sa-config-sync-a524 - `n45_a524/sa-site-publisher`: **GcpServiceAccount** sa-site-publisher-a524 - `n02_a524/bkt-site-build`: **GcpStorageBucket** bkt-site-build-a524 - `n33_a524/sa-release-audit`: **GcpServiceAccount** sa-release-audit-a524 - `n08_a524/bkt-release-archive`: **GcpStorageBucket** bkt-release-archive-a524 - `n44_a524/bkt-cdn-origin`: **GcpStorageBucket** bkt-cdn-origin-a524 - `n09_a524/bkt-public-docs`: **GcpStorageBucket** bkt-public-docs-a524 - `n31_a524/bkt-ml-features`: **GcpStorageBucket** bkt-ml-features-a524 - `n34_a524/feature-vectors`: **DataSet** feature-vectors-a524 - `n21_a524/bkt-billing-exports`: **GcpStorageBucket** bkt-billing-exports-a524 - `n41_a524/billing-statements`: **DataSet** billing-statements-a524 - `n40_a524/bkt-ml-features`: **GcpStorageBucket** bkt-ml-features-2-a524 - `n25_a524/feature-vectors`: **DataSet** feature-vectors-2-a524 - `n38_a524/pool-vendor-builds`: **GcpWorkloadIdentityPool** pool-vendor-builds-a524 - `n32_a524/pool-vendor-builds`: **GcpWorkloadIdentityPool** pool-vendor-builds-2-a524 - `n07_a524/sa-ci-runner`: **GcpServiceAccount** sa-ci-runner-a524 - `n27_a524/fld-platform`: **GcpFolder** fld-platform-a524 - `n24_a524/sa-lint-worker`: **GcpServiceAccount** sa-lint-worker-a524 - `n03_a524/prj-shared-tools`: **GcpProject** prj-shared-tools-a524 - `n14_a524/pool-partner-ci`: **GcpWorkloadIdentityPool** pool-partner-ci-a524 - `n18_a524/fld-data-eng`: **GcpFolder** fld-data-eng-a524 - `n17_a524/bkt-build-artifacts`: **GcpStorageBucket** bkt-build-artifacts-a524 - `n36_a524/bkt-telemetry-sink`: **GcpStorageBucket** bkt-telemetry-sink-a524 - `n06_a524/telemetry-sink`: **DataSet** telemetry-sink-a524 - `n22_a524/pool-partner-ci`: **GcpWorkloadIdentityPool** pool-partner-ci-2-a524 - `n10_a524/bkt-ci-cache`: **GcpStorageBucket** bkt-ci-cache-a524 - `n46_a524/prj-sandbox-dev`: **GcpProject** prj-sandbox-dev-a524 - `n28_a524/bkt-reporting-store`: **GcpStorageBucket** bkt-reporting-store-a524 - `n00_a524/reporting-store`: **DataSet** reporting-store-a524 - `n26_a524/bkt-ops-metrics`: **GcpStorageBucket** bkt-ops-metrics-a524 - `n12_a524/operational-metrics`: **DataSet** operational-metrics-a524 - `n35_a524/pool-partner-ci`: **GcpWorkloadIdentityPool** pool-partner-ci-3-a524 - `n05_a524/sa-build-agent`: **GcpServiceAccount** sa-build-agent-a524 - `n23_a524/bkt-ops-metrics`: **GcpStorageBucket** bkt-ops-metrics-2-a524 - `n29_a524/operational-metrics`: **DataSet** operational-metrics-2-a524 - `n15_a524/sa-build-agent`: **GcpServiceAccount** sa-build-agent-2-a524 - `n13_a524/pool-partner-ci`: **GcpWorkloadIdentityPool** pool-partner-ci-4-a524 - `n11_a524/pool-vendor-builds`: **GcpWorkloadIdentityPool** pool-vendor-builds-3-a524 - `n20_a524/fld-partners`: **GcpFolder** fld-partners-a524 ## Relationships - `n16_a524/org-cloud-enterprise` --organizational_child--> `n42_a524/prj-analytics-prod` - `n42_a524/prj-analytics-prod` --organizational_child--> `n39_a524/pool-github-actions` - `n39_a524/pool-github-actions` --federates_to--> `n43_a524/sa-workload-deployer` - `n43_a524/sa-workload-deployer` --impersonates--> `n37_a524/sa-cache-warmer` - `n37_a524/sa-cache-warmer` --impersonates--> `n01_a524/sa-report-builder` - `n01_a524/sa-report-builder` --impersonates--> `n19_a524/sa-config-sync` - `n19_a524/sa-config-sync` --can_read--> `n30_a524/bkt-enterprise-analytics` - `n30_a524/bkt-enterprise-analytics` --stores_sensitive_data--> `n04_a524/enterprise-analytics` - `n39_a524/pool-github-actions` --federates_to--> `n45_a524/sa-site-publisher` - `n45_a524/sa-site-publisher` --can_read--> `n02_a524/bkt-site-build` - `n33_a524/sa-release-audit` --can_read--> `n08_a524/bkt-release-archive` - `n31_a524/bkt-ml-features` --stores_sensitive_data--> `n34_a524/feature-vectors` - `n21_a524/bkt-billing-exports` --stores_sensitive_data--> `n41_a524/billing-statements` - `n40_a524/bkt-ml-features` --stores_sensitive_data--> `n25_a524/feature-vectors` - `n36_a524/bkt-telemetry-sink` --stores_sensitive_data--> `n06_a524/telemetry-sink` - `n28_a524/bkt-reporting-store` --stores_sensitive_data--> `n00_a524/reporting-store` - `n26_a524/bkt-ops-metrics` --stores_sensitive_data--> `n12_a524/operational-metrics` - `n23_a524/bkt-ops-metrics` --stores_sensitive_data--> `n29_a524/operational-metrics`
This estate was prebaked. A unique copy composes on the server in about 20 ms from a scenario spec: 10,000 seeds per family, 15 families. No cloud account was touched; the graph is the source of truth.
The grade is one call to TypeSafe Jev: three yes/no questions (entry, hop, sink) and one depth score (0 to 3, fewer rungs on a short path), typed probabilities back. No grade yet on this page.
cloudforge on GitHub