gcp-eventarc-explicit-cross-project-bus
An IAM binding on an Eventarc Advanced message bus granting publish rights to a principal in a different project.
match (record)
{
"api": "eventarc.projects.locations.messageBuses.getIamPolicy",
"field": "bindings[].members"
}
where
member (user:, serviceAccount:) belongs to a different project than the message bus
the binding includes eventarc.messageBuses.publish
emit
| source type | ResourcePolicy |
|---|---|
| target type | Project |
| source | <message bus IAM allow policy node (ResourcePolicy)> |
| target | <external project of the granted principal> |
Narrative
The IAM policy on message bus {bus.name} grants publish rights to a principal in project {ext_project.name}.
Raw rule rules/explicit/gcp-eventarc.yaml
id: gcp-eventarc-explicit-cross-project-bus
emits: CrossProjectTrust
description: An IAM binding on an Eventarc Advanced message bus granting publish rights to a principal
in a different project.
match_record:
api: eventarc.projects.locations.messageBuses.getIamPolicy
field: bindings[].members
where:
- member (user:, serviceAccount:) belongs to a different project than the message bus
- the binding includes eventarc.messageBuses.publish
emit:
source_type: ResourcePolicy
target_type: Project
source: <message bus IAM allow policy node (ResourcePolicy)>
target: <external project of the granted principal>
evidence_fields:
- iamPolicy.bindings[].members
- iamPolicy.bindings[].role
narrative: The IAM policy on message bus {bus.name} grants publish rights to a principal in project
{ext_project.name}.