rage.fail

azure-evg-partner-topic-cross-tenant-trust

explicit azure emits CrossTenantTrust

match (record)

{ "field": "properties.activationState", "resource_type": "Microsoft.EventGrid/partnerTopics" }

where

properties.activationState == Activated properties.partnerRegistrationImmutableId is non-empty

emit

source type	`Tenant`
target type	`Tenant`
source	`<customer Entra tenant (from subscription)`
target	`<external partner Entra tenant (identified by partnerRegistrationImmutableId)>`

Narrative

Event Grid partner topic {source.name} establishes cross-tenant trust: customer Entra tenant {source.tenant} trusts external partner Entra tenant {target.tenant} (registrationId: {properties.partnerRegistrationImmutableId}) to publish events.

Raw rule rules/explicit/azure-eventgrid.yaml

id: azure-evg-partner-topic-cross-tenant-trust
emits: CrossTenantTrust
applies_to:
- azure
match_record:
  resource_type: Microsoft.EventGrid/partnerTopics
  field: properties.activationState
where:
- properties.activationState == Activated
- properties.partnerRegistrationImmutableId is non-empty
emit:
  source_type: Tenant
  target_type: Tenant
  source: <customer Entra tenant (from subscription)
  target: <external partner Entra tenant (identified by partnerRegistrationImmutableId)>
  api_source: GET /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.EventGrid/partnerTopics
  evidence_field: properties.activationState + properties.partnerRegistrationImmutableId
  note: When a partner topic is Activated, the customer subscription establishes an explicit cross-tenant
    trust relationship with the external partner's Entra tenant. The partner is authorized to publish
    events into this subscription via the partner topic. Source is the customer Tenant boundary; target
    is the external partner Tenant.
  narrative: 'Event Grid partner topic {source.name} establishes cross-tenant trust: customer Entra tenant
    {source.tenant} trusts external partner Entra tenant {target.tenant} (registrationId: {properties.partnerRegistrationImmutableId})
    to publish events.'