apiVersion: constraints.gatekeeper.sh/v1alpha1
kind: GCPIAMAllowedBindingsConstraintV1
metadata:
  name: blacklist_serviceaccount_token_creator
  annotations:
    description: Ban any users from being granted Service Account Token Creator access
    # This constraint is not certified by CIS.
    bundles.validator.forsetisecurity.org/cis-v1.1: 1.0X  # TODO: Update this with final number when the CIS benchmark is finalized
spec:
  severity: high
  match:
    target: ["organization/*"]
    exclude: [] # optional, default is no exclusions
  parameters:
    mode: blacklist
    assetType: cloudresourcemanager.googleapis.com/Project
    role: roles/iam.serviceAccountTokenCreator
    members:
    - "*"

apiVersion: constraints.gatekeeper.sh/v1alpha1
kind: GCPIAMAllowedBindingsConstraintV1
metadata:
  name: blacklist_serviceaccount_token_creator
  annotations:
    description: Ban any users from being granted Service Account Token Creator access
    # This constraint is not certified by CIS.
    bundles.validator.forsetisecurity.org/cis-v1.1: 1.0X  # TODO: Update this with final number when the CIS benchmark is finalized
spec:
  severity: high
  match:
    target: ["organization/*"]
    exclude: [] # optional, default is no exclusions
  parameters:
    mode: blacklist
    assetType: cloudresourcemanager.googleapis.com/Project
    role: roles/iam.serviceAccountTokenCreator
    members:
    - "*" # Although it is still okay to use "*" to match all, consider using "**" (see https://www.openpolicyagent.org/docs/latest/policy-reference/#glob)

Add comment to suggest switching to '**' for match-all pattern
Add comment to suggest switching to '**' for match-all pattern
