gcp-cloudscheduler-appengine-trigger-binding
A Cloud Scheduler App Engine HTTP job triggers an App Engine service on schedule. App Engine targets are always same-project. OIDC/OAuth2 auth model applies identically to HTTP targets.
match (record)
{
"field": "appEngineHttpTarget.relativeUri",
"resource_type": "google.cloud.scheduler.v1.Job"
}
where
appEngineHttpTarget.relativeUri is set (non-empty)
job.state == ENABLED
emit
| source type | Scheduler |
|---|---|
| target type | ApplicationPlatform |
| source | <Cloud Scheduler job (Scheduler node)> |
| target | <App Engine service (ApplicationPlatform node)> |
| conditions | service_state |
| state logic | ACTIVE when job.state == ENABLED. CONDITIONAL(service_state) when PAUSED. BLOCKED when DISABLED/UPDATE_FAILED. App Engine targets are always same-project and reachable — no network_reachability condition. |
Narrative
{job.name} fires a request to {appengine_service.name} App Engine service on its cron schedule.
Raw rule rules/derived/gcp/cloudscheduler.yaml
id: gcp-cloudscheduler-appengine-trigger-binding
emits: CanTrigger
description: A Cloud Scheduler App Engine HTTP job triggers an App Engine service on schedule. App Engine
targets are always same-project. OIDC/OAuth2 auth model applies identically to HTTP targets.
match_record:
resource_type: google.cloud.scheduler.v1.Job
field: appEngineHttpTarget.relativeUri
where:
- appEngineHttpTarget.relativeUri is set (non-empty)
- job.state == ENABLED
emit:
source_type: Scheduler
target_type: ApplicationPlatform
source: <Cloud Scheduler job (Scheduler node)>
target: <App Engine service (ApplicationPlatform node)>
permissions: []
derived_from:
- job.appEngineHttpTarget.relativeUri; job.state == ENABLED
conditions:
- service_state
state_logic: "ACTIVE when job.state == ENABLED. CONDITIONAL(service_state) when PAUSED. BLOCKED when\
\ DISABLED/UPDATE_FAILED. App Engine targets are always same-project and reachable \u2014 no network_reachability\
\ condition."
false_positive_note: App Engine HTTP targets always target the same project's App Engine application.
The appEngineRouting fields (service, version, instance) scope the delivery to a specific App Engine
service/version/instance; resolve these to the correct App Engine node. The OIDC/OAuth2 SA model and
actAs requirement are identical to HTTP targets.
narrative: '{job.name} fires a request to {appengine_service.name} App Engine service on its cron schedule.'