azure-evg-topic-admin
Full control of an Event Grid topic (EventGrid Contributor / Contributor / Owner).
match (effective permission)
{
"action": "Microsoft.EventGrid/topics/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds EventGrid Contributor, Contributor, Owner, or a custom role granting Microsoft.EventGrid/topics/* at the scope
emit
| source type | Identity |
|---|---|
| target type | EventBus |
| source | <principal> |
| target | <Event Grid topic (EventBus) in scope> |
| permissions | Microsoft.EventGrid/topics/write |
| state logic | ACTIVE when the effective permission is confirmed. BLOCKED if a deny assignment covers topics/write at the scope. CanAdminister(topic) does NOT imply Microsoft.Authorization/*/write; escalation is via the topic key (CanReadSecret) or subscription endpoint redirect (CanModifyConfiguration), not role self-assignment. |
Narrative
{principal.name} has full administrative control of Event Grid topic {target.name} (Microsoft.EventGrid/topics/*), including key retrieval and subscription management.
Raw rule rules/derived/azure/eventgrid.yaml
id: azure-evg-topic-admin
emits: CanAdminister
description: Full control of an Event Grid topic (EventGrid Contributor / Contributor / Owner).
match_effective_permission:
action: Microsoft.EventGrid/topics/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds EventGrid Contributor, Contributor, Owner, or a custom role granting Microsoft.EventGrid/topics/*
at the scope
emit:
source_type: Identity
target_type: EventBus
source: <principal>
target: <Event Grid topic (EventBus) in scope>
permissions:
- Microsoft.EventGrid/topics/write
conditions: []
state_logic: ACTIVE when the effective permission is confirmed. BLOCKED if a deny assignment covers
topics/write at the scope. CanAdminister(topic) does NOT imply Microsoft.Authorization/*/write; escalation
is via the topic key (CanReadSecret) or subscription endpoint redirect (CanModifyConfiguration), not
role self-assignment.
confidence: 0.98
derived_from:
- 'effective permission: Microsoft.EventGrid/topics/write'
false_positive_note: EventGrid Contributor grants full control of topics, domains, subscriptions, and
partner resources but NOT Microsoft.Authorization/*/write. An attacker holding this role can retrieve
topic keys (listKeys/action) and redirect subscriptions but cannot directly grant themselves roles
elsewhere. EventGrid EventSubscription Contributor does NOT include topics/write; it grants only eventSubscriptions/*
scoped operations.
narrative: '{principal.name} has full administrative control of Event Grid topic {target.name} (Microsoft.EventGrid/topics/*),
including key retrieval and subscription management.'