mapping-service-account-impersonation-chains

name	mapping-service-account-impersonation-chains
description	Map service-account impersonation and token-generation paths that let a principal act as a more-privileged identity: a role granting impersonation or token creation on a service account, an actAs or token-creator permission that chains one identity into another, and a sequence of such grants that reaches a highly privileged account from a low-privileged start. Covers cloud service-account impersonation, short-lived-token generation, and the transitive graph where each impersonation grant is an edge from one identity to another. Use when principals can impersonate service accounts or mint tokens for them and you need to know where those edges lead. The principal holding an impersonation grant is the source, the impersonate or token-generation call is the sink, and the reachable privileged identity at the chain's end is the bug.
license	MIT

Mapping service-account impersonation chains: when one identity can become another

Cloud identity models let a principal act as a service account through impersonation or short-lived-token generation, and each such grant is an edge in a graph: whoever holds it can become the target identity and inherit its permissions. Individually these grants look benign, a deployment principal impersonating a deploy account, an automation user minting a token for a job account. The risk is transitive. If the target account can itself impersonate a third, and that a fourth, a low-privileged starting principal can walk the chain into an administrative identity no single grant intended. You find these by treating impersonation and token-creator grants as edges and mapping where a starting principal can reach.

When to use

• Principals can impersonate service accounts or generate short-lived tokens for them.
• An actAs, token-creator, or equivalent grant lets one identity act as another.
• You need to know the transitive reach of a starting principal through chained impersonation.