iamcredentials.locations.workforcePools.getAllowedLocations

valid {
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

iamcredentials.projects.locations.workloadIdentityPools.getAllowedLocations

valid {
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

iamcredentials.projects.serviceAccounts.generateAccessToken

valid {
    input.Body.delegates[_] == STRING
    input.Body.lifetime == STRING
    input.Body.scope[_] == STRING
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

iamcredentials.projects.serviceAccounts.generateIdToken

valid {
    input.Body.audience == STRING
    input.Body.delegates[_] == STRING
    input.Body.includeEmail == BOOLEAN
    input.Body.organizationNumberIncluded == BOOLEAN
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

iamcredentials.projects.serviceAccounts.getAllowedLocations

valid {
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

iamcredentials.projects.serviceAccounts.signBlob

valid {
    input.Body.delegates[_] == STRING
    input.Body.payload == STRING
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

iamcredentials.projects.serviceAccounts.signJwt

valid {
    input.Body.delegates[_] == STRING
    input.Body.payload == STRING
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}