gcp-eventarc-create-trigger
eventarc.triggers.create lets an attacker bind any reachable event source to any destination consumer as an Eventarc trigger - the event-source-binding creation primitive (Phase-10 CanSchedule).
match (effective permission)
{
"action": "eventarc.triggers.create",
"resource_type": "google.cloud.eventarc.v1.Trigger"
}
where
principal also holds iam.serviceAccounts.actAs on the trigger SA to be configured (required to set trigger.serviceAccount)
trigger SA holds the appropriate invoker role on the intended destination
emit
| source type | Identity |
|---|---|
| target type | EventRule |
| source | <principal> |
| target | <new Eventarc trigger (EventRule)> |
| permissions | eventarc.triggers.create iam.serviceAccounts.actAs |
| conditions | role_compatibility iam_permission |
| state logic | ACTIVE when the principal holds eventarc.triggers.create AND iam.serviceAccounts.actAs on the trigger SA AND the trigger SA holds an invoker role on the chosen destination. POTENTIAL(role_compatibility) when actAs on the trigger SA is unknown or unresolved, or when the trigger SA's invoker rights on the destination are unconfirmed. BLOCKED when an IAM deny or org policy denies eventarc.triggers.create or iam.serviceAccounts.actAs at the effective scope. |
Narrative
{principal.name} can create an Eventarc trigger (eventarc.triggers.create + iam.serviceAccounts.actAs on trigger SA) binding any event source (Pub/Sub, Audit Log, GCS, message bus) to a destination consumer, establishing persistent event-driven execution as the consumer's runtime service account.
Raw rule rules/derived/gcp/eventarc.yaml
id: gcp-eventarc-create-trigger
emits: CanSchedule
description: "eventarc.triggers.create lets an attacker bind any reachable event source to any destination\
\ consumer as an Eventarc trigger \u2014 the event-source-binding creation primitive (Phase-10 CanSchedule)."
match_effective_permission:
action: eventarc.triggers.create
resource_type: google.cloud.eventarc.v1.Trigger
where:
- principal also holds iam.serviceAccounts.actAs on the trigger SA to be configured (required to set trigger.serviceAccount)
- trigger SA holds the appropriate invoker role on the intended destination
emit:
source_type: Identity
target_type: EventRule
source: <principal>
target: <new Eventarc trigger (EventRule)>
permissions:
- eventarc.triggers.create
- iam.serviceAccounts.actAs
conditions:
- role_compatibility
- iam_permission
state_logic: ACTIVE when the principal holds eventarc.triggers.create AND iam.serviceAccounts.actAs
on the trigger SA AND the trigger SA holds an invoker role on the chosen destination. POTENTIAL(role_compatibility)
when actAs on the trigger SA is unknown or unresolved, or when the trigger SA's invoker rights on
the destination are unconfirmed. BLOCKED when an IAM deny or org policy denies eventarc.triggers.create
or iam.serviceAccounts.actAs at the effective scope.
derived_from:
- 'effective permission: eventarc.triggers.create on the project/location scope'
- 'effective permission: iam.serviceAccounts.actAs on the trigger SA'
false_positive_note: "Creating an Eventarc trigger requires actAs on the trigger SA \u2014 without it\
\ the API call fails. The trigger SA must then hold an appropriate invoker role on the destination\
\ (e.g. roles/run.invoker on the Cloud Run service, roles/workflows.invoker on the workflow); without\
\ this the trigger is created but event delivery returns 403/404 \u2014 degrade the resulting CanTrigger\
\ edge to CONDITIONAL. This CanSchedule feeds messaging-chains rule 3 (messaging-schedule-persists-executes-as)\
\ where the trigger invokes a consumer that runs as a chosen SA, giving persistent event-driven execution\
\ as that SA's identity. Also feeds rule 1 (messaging-publish-triggers-consumer) via the new CanTrigger\
\ binding."
narrative: '{principal.name} can create an Eventarc trigger (eventarc.triggers.create + iam.serviceAccounts.actAs
on trigger SA) binding any event source (Pub/Sub, Audit Log, GCS, message bus) to a destination consumer,
establishing persistent event-driven execution as the consumer''s runtime service account.'