rage.fail

azure-evg-partner-topic-activated

explicit azure emits HasPolicy

match (record)

{ "field": "properties.activationState", "resource_type": "Microsoft.EventGrid/partnerTopics" }

where

properties.activationState == Activated

emit

source type	`*`
target type	`Policy`
source	`<Event Grid partner topic>`
target	`<partner activation policy (GenericPolicy — represents the cross-tenant publish trust)>`

Narrative

Event Grid partner topic {source.name} is Activated; external partner (registrationId: {properties.partnerRegistrationImmutableId}) from an external Entra tenant is authorized to publish events into this subscription.

Raw rule rules/explicit/azure-eventgrid.yaml

id: azure-evg-partner-topic-activated
emits: HasPolicy
applies_to:
- azure
match_record:
  resource_type: Microsoft.EventGrid/partnerTopics
  field: properties.activationState
where:
- properties.activationState == Activated
emit:
  source_type: '*'
  target_type: Policy
  source: <Event Grid partner topic>
  target: "<partner activation policy (GenericPolicy \u2014 represents the cross-tenant publish trust)>"
  api_source: GET /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.EventGrid/partnerTopics
  evidence_field: properties.activationState + properties.partnerRegistrationImmutableId
  note: An Activated partner topic signals that the named external partner (properties.partnerRegistrationImmutableId
    from an external Entra tenant) is authorized to publish events into this subscription's partner topic.
    Feeds azure-evg-partner-topic-cross-tenant-trust (CrossTenantTrust) explicit rule below. Record properties.partnerRegistrationImmutableId
    on the edge evidence so the external tenant can be identified for path-finding.
  narrative: 'Event Grid partner topic {source.name} is Activated; external partner (registrationId: {properties.partnerRegistrationImmutableId})
    from an external Entra tenant is authorized to publish events into this subscription.'