azure-evg-topic-admin

Full control of an Event Grid topic (EventGrid Contributor / Contributor / Owner).

derived azure emits CanAdminister

match (effective permission)

{ "action": "Microsoft.EventGrid/topics/write", "scope_type": "resource|resourceGroup|subscription" }

where

principal effectively holds EventGrid Contributor, Contributor, Owner, or a custom role granting Microsoft.EventGrid/topics/* at the scope

emit

source typeIdentity
target typeEventBus
source<principal>
target<Event Grid topic (EventBus) in scope>
permissionsMicrosoft.EventGrid/topics/write
state logicACTIVE when the effective permission is confirmed. BLOCKED if a deny assignment covers topics/write at the scope. CanAdminister(topic) does NOT imply Microsoft.Authorization/*/write; escalation is via the topic key (CanReadSecret) or subscription endpoint redirect (CanModifyConfiguration), not role self-assignment.

Narrative

{principal.name} has full administrative control of Event Grid topic {target.name} (Microsoft.EventGrid/topics/*), including key retrieval and subscription management.

Raw rule rules/derived/azure/eventgrid.yaml

id: azure-evg-topic-admin
emits: CanAdminister
description: Full control of an Event Grid topic (EventGrid Contributor / Contributor / Owner).
match_effective_permission:
  action: Microsoft.EventGrid/topics/write
  scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds EventGrid Contributor, Contributor, Owner, or a custom role granting Microsoft.EventGrid/topics/*
  at the scope
emit:
  source_type: Identity
  target_type: EventBus
  source: <principal>
  target: <Event Grid topic (EventBus) in scope>
  permissions:
  - Microsoft.EventGrid/topics/write
  conditions: []
  state_logic: ACTIVE when the effective permission is confirmed. BLOCKED if a deny assignment covers
    topics/write at the scope. CanAdminister(topic) does NOT imply Microsoft.Authorization/*/write; escalation
    is via the topic key (CanReadSecret) or subscription endpoint redirect (CanModifyConfiguration), not
    role self-assignment.
  confidence: 0.98
  derived_from:
  - 'effective permission: Microsoft.EventGrid/topics/write'
  false_positive_note: EventGrid Contributor grants full control of topics, domains, subscriptions, and
    partner resources but NOT Microsoft.Authorization/*/write. An attacker holding this role can retrieve
    topic keys (listKeys/action) and redirect subscriptions but cannot directly grant themselves roles
    elsewhere. EventGrid EventSubscription Contributor does NOT include topics/write; it grants only eventSubscriptions/*
    scoped operations.
  narrative: '{principal.name} has full administrative control of Event Grid topic {target.name} (Microsoft.EventGrid/topics/*),
    including key retrieval and subscription management.'
move · open · esc close