gcp/monitoring/policies/wif-deploy-auth.json

{
  "displayName": "insights-api WIF or deploy SA auth failure",
  "combiner": "OR",
  "severity": "ERROR",
  "enabled": true,
  "summary": "Log match for Workload Identity Federation or github-deploy-sa authentication failures.",
  "documentation": {
    "content": "Matches Cloud Audit logs where github-deploy-sa or the GitHub Workload Identity pool fails to mint a token or call Cloud Run. The project number 000000000000 is a placeholder. This policy is not deployed.",
    "mimeType": "text/markdown"
  },
  "conditions": [
    {
      "displayName": "WIF or deploy authentication error",
      "conditionMatchedLog": {
        "filter": "severity>=ERROR AND (protoPayload.authenticationInfo.principalEmail=\"github-deploy-sa@thistle-analytics-demo.iam.gserviceaccount.com\" OR protoPayload.status.message=~\"workloadIdentityPools/github-pool\")"
      }
    }
  ],
  "notificationChannels": [
    "projects/thistle-analytics-demo/notificationChannels/placeholder-channel"
  ]
}