GCP Workload Identity Pool Disabled or Deleted
This rule detects when a Google Cloud Workload Identity Pool is either disabled or deleted. Workload Identity Pools are used to manage external identities (e.g., from AWS, Azure, or on-premises identity providers) that need to access Google Cloud resources. Disabling or deleting a Workload Identity Pool will immediately revoke access for all federated identities associated with that pool, potentially leading to a denial of service for legitimate users or indicating an attempt by an attacker to disrupt operations or remove traces of their access. The rule specifically looks for the 'google.iam.v1.WorkloadIdentityPools.DeleteWorkloadIdentityPool' event or an 'google.iam.v1.WorkloadIdentityPools.UpdateWorkloadIdentityPool' event where the 'req_identityPool_disabled' attribute is set to 'true'.
YARA-L
