gcp-eventarc-bus-cross-project-trust
An IAM binding on an Eventarc Advanced message bus granting eventarc.messageBuses.publish to a principal in a different project is cross-project event-injection trust - that external principal can drive all pipelines bound to the bus.
match (record)
{
"field": "iamPolicy.bindings",
"resource_type": "google.cloud.eventarc.v1.MessageBus"
}
where
a binding member (user:, serviceAccount:) belongs to a different project than the message bus
the binding grants eventarc.messageBuses.publish
emit
| source type | ResourcePolicy |
|---|---|
| target type | Project |
| source | <message bus IAM allow policy (ResourcePolicy)> |
| target | <external project of the granted principal> |
| conditions | resource_policy condition_expression |
| state logic | ACTIVE when the binding unconditionally grants eventarc.messageBuses.publish to an external principal. CONDITIONAL(condition_expression) when scoped by an IAM condition. BLOCKED by an org policy or IAM deny denying the grant. |
Narrative
The IAM policy on Eventarc Advanced message bus {bus.name} grants a principal in project {ext_project.name} eventarc.messageBuses.publish, creating cross-project event-injection trust; that external principal can drive all pipelines bound to the bus, triggering consumers in this project.
Raw rule rules/derived/gcp/eventarc.yaml
id: gcp-eventarc-bus-cross-project-trust
emits: CrossProjectTrust
description: "An IAM binding on an Eventarc Advanced message bus granting eventarc.messageBuses.publish\
\ to a principal in a different project is cross-project event-injection trust \u2014 that external\
\ principal can drive all pipelines bound to the bus."
match_record:
resource_type: google.cloud.eventarc.v1.MessageBus
field: iamPolicy.bindings
where:
- a binding member (user:, serviceAccount:) belongs to a different project than the message bus
- the binding grants eventarc.messageBuses.publish
emit:
source_type: ResourcePolicy
target_type: Project
source: <message bus IAM allow policy (ResourcePolicy)>
target: <external project of the granted principal>
permissions: []
conditions:
- resource_policy
- condition_expression
state_logic: ACTIVE when the binding unconditionally grants eventarc.messageBuses.publish to an external
principal. CONDITIONAL(condition_expression) when scoped by an IAM condition. BLOCKED by an org policy
or IAM deny denying the grant.
derived_from:
- "messageBus.iamPolicy.bindings \u2014 cross-project publish grant"
false_positive_note: "CITE, DO NOT DUPLICATE can-control and messaging-chains rule 4: this rule asserts\
\ the cross-project publish trust. The CanEnterProject rollup (publish to bus \u2192 pipeline \u2192\
\ consumer \u2192 CanExecuteAs runtime SA in the bus's project) is can-control's. A publish grant\
\ that reaches NO active pipeline in the bus is trust without an execution path \u2014 validate that\
\ active pipelines with live consumers exist before connecting this to CanEnterProject reasoning."
narrative: The IAM policy on Eventarc Advanced message bus {bus.name} grants a principal in project
{ext_project.name} eventarc.messageBuses.publish, creating cross-project event-injection trust; that
external principal can drive all pipelines bound to the bus, triggering consumers in this project.