OpenGraph IAM Conditionals

OpenGraph - IAM Conditionals

Status

Pass-through (placeholder). IAM conditions are recorded and carried through the graph, but the CEL expression is not evaluated. Full conditional narrowing is planned for a future pass.

Current Behavior

GCPwn supports the --cond-eval flag in pass-through mode for OpenGraph generation. A conditioned IAM binding is preserved and tagged, but the condition does not change which resources/edges are emitted.

In practice, this means:

• Conditional evaluation is not yet doing full policy-conditional pruning. The CEL expression is captured but never parsed/evaluated.
• --cond-eval does not narrow resources or edges. Graph output is identical whether the flag is on or off; the flag only runs the conditionals workflow in pass-through mode.
• Condition-aware edge narrowing is not yet modeled in output.

How Conditioned Bindings Appear

When a binding carries an IAM condition with a non-empty expression, the binding node is kept distinct (so a conditioned binding never collapses into the unconditioned binding at the same role/scope) and is tagged with provenance:

• The binding node id gets a deterministic suffix #cond:<hash>, where <hash> is a 10-character hex SHA1 of the trimmed condition expression.
• The node carries properties:
  • conditional = true
  • condition_expr_raw — the raw CEL expression text (truncated for display)
  • condition_hash — the same 10-hex hash used in the id suffix

Because the suffix and condition_hash are derived deterministically from the expression text:

• The same condition expression always produces the same hash, so identical conditions on the same role/scope dedup into one binding node.
• Distinct expressions produce distinct hashes, so they stay as separate binding nodes.

Example id shape:

iambinding:roles/owner@projects/example-proj#cond:1a2b3c4d5e

A binding that is both inherited and conditioned carries both suffixes, source first then condition:

iambinding:roles/owner@projects/example-proj#src:<source-scope>#cond:1a2b3c4d5e

See OpenGraph - Inheritance & Include-All for the #src: inheritance suffix.

Usage

modules run process_og_gcpwn_data --cond-eval --reset --out Bloodhound_Output.json

Since output is identical with or without --cond-eval today, use it only when exercising the conditional pass-through workflow itself. The conditioned bindings (with the #cond: suffix and conditional/condition_expr_raw/ condition_hash properties) are emitted regardless of the flag.

What Will Be Documented Here

• how conditional IAM expressions will affect edge emission once CEL evaluation lands
• expected graph differences when conditionals actually narrow scope
• troubleshooting guidance for conditional path mismatches

For now, see:

• OpenGraph Overview and Usage
• OpenGraph - Inheritance & Include-All