Document tested Workload Identity Federation takeover paths

[carlospolop]

Summary

• document five independently tested Workload Identity Federation escalation/restoration paths
• cover provider create, provider update, provider undelete, pool update, and pool undelete permissions
• state the residual trust and IAM prerequisites so these are not presented as unconditional privilege escalation
• add exact REST/STS reproduction, permission-free identifier fallbacks, detection, and cleanup guidance

Live validation

Validated on 2026-09-08 in gcp-labs-ly3gvnn7 using disposable SAML pools/providers and a separate single-permission custom role for every path. Each test first proved the attacker assertion was rejected. The exact operation was then performed and its long-running operation completed; the same signed assertion obtained an STS token and successfully read the project.

Validated exact permissions:

• iam.googleapis.com/workloadIdentityPoolProviders.create
• iam.googleapis.com/workloadIdentityPoolProviders.update
• iam.googleapis.com/workloadIdentityPoolProviders.undelete
• iam.googleapis.com/workloadIdentityPools.update
• iam.googleapis.com/workloadIdentityPools.undelete

All active test IAM bindings, service accounts, custom roles, providers, and pools were removed. Deleted WIF IDs and custom roles remain only as inactive soft-deletion tombstones.

Checks

• documentation navigation, anchors, and cross-link targets verified
• git diff --check clean
• CloudPEASS full suite: 350 passed, 1 skipped, 210 subtests passed