azure-evg-subscription-binding

id: azure-evg-subscription-binding
emits: CanTrigger
applies_to:
- azure
match_record:
  resource_type: Microsoft.EventGrid/eventSubscriptions
  field: properties.destination.endpointType
where:
- properties.provisioningState == Succeeded
- properties.destination.endpointType in [WebHook, AzureFunction, ServiceBusQueue, ServiceBusTopic, StorageQueue,
  EventHub, HybridConnection]
emit:
  source_type: EventBus
  target_type: Compute
  source: <topic or system topic that the subscription is on (EventBus node)>
  target: "<consumer at the destination endpoint \u2014 ServerlessFunction (AzureFunction), Webhook (WebHook),\
    \ Queue (ServiceBusQueue/StorageQueue), Topic (ServiceBusTopic), GenericMessaging (EventHub), GenericCompute\
    \ (HybridConnection)>"
  api_source: GET <resource>/providers/Microsoft.EventGrid/eventSubscriptions
  evidence_field: properties.destination.properties.resourceId OR properties.destination.endpointUrl
  note: "Event type filter at properties.filter.includedEventTypes narrows which events reach the consumer.\
    \ If the filter is a strict allowlist (e.g., only Microsoft.Storage.BlobCreated), record it on the\
    \ edge conditions so the linter can downgrade to CONDITIONAL(condition_expression) when the attacker\
    \ cannot publish a matching event type. AzureFunction endpoints reference the Function app resource\
    \ ID \u2014 resolve to a ServerlessFunction node. ServiceBusQueue and ServiceBusTopic resolve to Queue/Topic\
    \ nodes (further consumers may chain)."
  narrative: 'Event Grid subscription routes events from {source.name} to {target.name} (endpointType:
    {endpointType}); any event published to the topic triggers the consumer.'