gcp-eventarc-explicit-delivery-sa
An Eventarc trigger uses its serviceAccount field as the delivery identity when calling the destination endpoint.
match (record)
{
"api": "eventarc.projects.locations.triggers.get",
"field": "serviceAccount"
}
emit
| source type | EventRule |
|---|---|
| target type | ServiceAccount |
| source | <Eventarc trigger node that authenticates event delivery as its configured service account> |
| target | <trigger service account node (ServiceAccount)> |
Narrative
Eventarc trigger {trigger.name} authenticates event delivery using service account {sa.name}.
Raw rule rules/explicit/gcp-eventarc.yaml
id: gcp-eventarc-explicit-delivery-sa
emits: ExecutesAs
description: An Eventarc trigger uses its serviceAccount field as the delivery identity when calling the
destination endpoint.
match_record:
api: eventarc.projects.locations.triggers.get
field: serviceAccount
emit:
source_type: EventRule
target_type: ServiceAccount
source: <Eventarc trigger node that authenticates event delivery as its configured service account>
target: <trigger service account node (ServiceAccount)>
evidence_fields:
- trigger.serviceAccount
narrative: Eventarc trigger {trigger.name} authenticates event delivery using service account {sa.name}.