gcp-cloudscheduler-http-trigger-binding
A Cloud Scheduler HTTP job binds to a compute target (Cloud Run, Cloud Functions, App Engine, or other HTTP endpoint). The job fires on schedule sending the OIDC/OAuth2 bearer - this is the CanTrigger binding fact consumed by messaging-chains.
match (record)
{
"field": "httpTarget.uri",
"resource_type": "google.cloud.scheduler.v1.Job"
}
where
httpTarget.uri resolves to a known Compute node (Cloud Run service URL, Cloud Functions gen1/gen2 endpoint, App Engine URL, Workflows executions.create endpoint)
job.state == ENABLED
emit
| source type | Scheduler |
|---|---|
| target type | Compute |
| source | <Cloud Scheduler job (Scheduler node)> |
| target | <HTTP target compute node (ServerlessFunction / ContainerService / ApplicationPlatform / Workflow)> |
| conditions | service_state network_reachability |
| state logic | ACTIVE when job.state == ENABLED and the URI resolves to a known compute target node. CONDITIONAL(service_state) when the job is PAUSED (manual trigger via jobs.run still works). CONDITIONAL(network_reachability) when the target is a private endpoint (Cloud Scheduler cannot reach private VPC IPs — only publicly addressed endpoints are reachable). BLOCKED when job.state is DISABLED or UPDATE_FAILED. |
Narrative
{job.name} fires an HTTP request to {target.name} on its cron schedule, carrying the OIDC/OAuth2 token of the configured SA. This CanTrigger feeds messaging-chains rules 1+2 for the CanExecuteAs roll-up when {target.name} ExecutesAs a runtime SA.
Raw rule rules/derived/gcp/cloudscheduler.yaml
id: gcp-cloudscheduler-http-trigger-binding
emits: CanTrigger
description: "A Cloud Scheduler HTTP job binds to a compute target (Cloud Run, Cloud Functions, App Engine,\
\ or other HTTP endpoint). The job fires on schedule sending the OIDC/OAuth2 bearer \u2014 this is the\
\ CanTrigger binding fact consumed by messaging-chains."
match_record:
resource_type: google.cloud.scheduler.v1.Job
field: httpTarget.uri
where:
- httpTarget.uri resolves to a known Compute node (Cloud Run service URL, Cloud Functions gen1/gen2 endpoint,
App Engine URL, Workflows executions.create endpoint)
- job.state == ENABLED
emit:
source_type: Scheduler
target_type: Compute
source: <Cloud Scheduler job (Scheduler node)>
target: <HTTP target compute node (ServerlessFunction / ContainerService / ApplicationPlatform / Workflow)>
permissions: []
derived_from:
- job.httpTarget.uri resolved to compute node self-link; job.state == ENABLED
conditions:
- service_state
- network_reachability
state_logic: "ACTIVE when job.state == ENABLED and the URI resolves to a known compute target node.\
\ CONDITIONAL(service_state) when the job is PAUSED (manual trigger via jobs.run still works). CONDITIONAL(network_reachability)\
\ when the target is a private endpoint (Cloud Scheduler cannot reach private VPC IPs \u2014 only\
\ publicly addressed endpoints are reachable). BLOCKED when job.state is DISABLED or UPDATE_FAILED."
false_positive_note: Cloud Scheduler sends HTTP requests from Google's infrastructure IP ranges (not
the project VPC). Only publicly addressed endpoints are reachable (Cloud Run default URLs, Cloud Functions
HTTPS triggers, App Engine default URLs, public googleapis.com endpoints). Do NOT emit ACTIVE for
VPC-internal targets (no public IP, no Cloud Endpoints). Resolve httpTarget.uri to a known node via
URL pattern matching; unresolved URIs (external third-party endpoints) should not produce a CanTrigger
edge to an internal compute node.
narrative: '{job.name} fires an HTTP request to {target.name} on its cron schedule, carrying the OIDC/OAuth2
token of the configured SA. This CanTrigger feeds messaging-chains rules 1+2 for the CanExecuteAs
roll-up when {target.name} ExecutesAs a runtime SA.'