gcp-eventarc-explicit-cross-project-trigger
An IAM binding on an Eventarc trigger granting trigger management permissions to a principal in a different project.
match (record)
{
"api": "eventarc.projects.locations.triggers.getIamPolicy",
"field": "bindings[].members"
}
where
member (user:, serviceAccount:) belongs to a different project than the trigger
the binding includes eventarc.triggers.update, eventarc.triggers.create, or a role containing those (roles/eventarc.developer, roles/eventarc.admin)
emit
| source type | ResourcePolicy |
|---|---|
| target type | Project |
| source | <trigger IAM allow policy node (ResourcePolicy)> |
| target | <external project of the granted principal> |
Narrative
The IAM policy of {trigger.name} grants trigger management rights to a principal in project {ext_project.name}.
Raw rule rules/explicit/gcp-eventarc.yaml
id: gcp-eventarc-explicit-cross-project-trigger
emits: CrossProjectTrust
description: An IAM binding on an Eventarc trigger granting trigger management permissions to a principal
in a different project.
match_record:
api: eventarc.projects.locations.triggers.getIamPolicy
field: bindings[].members
where:
- member (user:, serviceAccount:) belongs to a different project than the trigger
- the binding includes eventarc.triggers.update, eventarc.triggers.create, or a role containing those
(roles/eventarc.developer, roles/eventarc.admin)
emit:
source_type: ResourcePolicy
target_type: Project
source: <trigger IAM allow policy node (ResourcePolicy)>
target: <external project of the granted principal>
evidence_fields:
- iamPolicy.bindings[].members
- iamPolicy.bindings[].role
narrative: The IAM policy of {trigger.name} grants trigger management rights to a principal in project
{ext_project.name}.