gcp-eventarc-publish-to-trigger
Publishing to an Eventarc-managed Pub/Sub transport topic directly triggers the bound destination consumer - collapses the Topic → EventRule → Compute chain into a single CanTrigger(Topic → Compute) for messaging-chains rule 1.
match (record)
{
"field": [
"transport.pubsub.topic",
"destination"
],
"resource_type": "google.cloud.eventarc.v1.Trigger"
}
where
trigger.transport.pubsub.topic is set (Pub/Sub-backed trigger)
trigger.state == ACTIVE
trigger.destination is set to one of: cloudRun, workflow, gke, cloudFunction
emit
| source type | Topic |
|---|---|
| target type | Compute |
| source | <Eventarc transport Pub/Sub topic (Topic)> |
| target | <destination consumer (Cloud Run / Workflow / Cloud Function / GKE workload)> |
| conditions | trigger_exists service_state |
| state logic | ACTIVE when the transport topic exists, the trigger is ACTIVE, and the trigger SA holds an invoker role on the destination (event delivery succeeds). CONDITIONAL(service_state) when the destination is not deployed/enabled. BLOCKED when the trigger.state is FAILED or PROVISIONING. CONDITIONAL(condition_expression) if the trigger has narrow event filters the attacker payload may not satisfy. |
Narrative
Publishing to Pub/Sub topic {topic.name} (the Eventarc transport backing trigger {trigger.name}) delivers an attacker-controlled CloudEvent to {consumer.name}.
Raw rule rules/derived/gcp/eventarc.yaml
id: gcp-eventarc-publish-to-trigger
emits: CanTrigger
description: "Publishing to an Eventarc-managed Pub/Sub transport topic directly triggers the bound destination\
\ consumer \u2014 collapses the Topic \u2192 EventRule \u2192 Compute chain into a single CanTrigger(Topic\
\ \u2192 Compute) for messaging-chains rule 1."
match_record:
resource_type: google.cloud.eventarc.v1.Trigger
field:
- transport.pubsub.topic
- destination
where:
- trigger.transport.pubsub.topic is set (Pub/Sub-backed trigger)
- trigger.state == ACTIVE
- 'trigger.destination is set to one of: cloudRun, workflow, gke, cloudFunction'
emit:
source_type: Topic
target_type: Compute
source: <Eventarc transport Pub/Sub topic (Topic)>
target: <destination consumer (Cloud Run / Workflow / Cloud Function / GKE workload)>
permissions: []
conditions:
- trigger_exists
- service_state
state_logic: ACTIVE when the transport topic exists, the trigger is ACTIVE, and the trigger SA holds
an invoker role on the destination (event delivery succeeds). CONDITIONAL(service_state) when the
destination is not deployed/enabled. BLOCKED when the trigger.state is FAILED or PROVISIONING. CONDITIONAL(condition_expression)
if the trigger has narrow event filters the attacker payload may not satisfy.
derived_from:
- trigger.transport.pubsub.topic + trigger.destination + trigger.state == ACTIVE
false_positive_note: "This edge collapses the intermediate EventRule (Eventarc trigger node) into a\
\ direct Topic \u2192 Compute link for use by messaging-chains rule 1 (CanWriteData on topic \u2192\
\ CanTrigger(topic \u2192 consumer)). The EventRule node still exists in the graph (via gcp-eventarc-trigger-routes-to-consumer);\
\ this edge feeds messaging-chains' rollup. Always gate on trigger.state == ACTIVE. The trigger SA\
\ must hold invoker rights on the destination. Honor event filters as CONDITIONAL gates."
narrative: Publishing to Pub/Sub topic {topic.name} (the Eventarc transport backing trigger {trigger.name})
delivers an attacker-controlled CloudEvent to {consumer.name}.