gcp-eventarc-set-bus-iam-policy
eventarc.messageBuses.setIamPolicy lets an attacker grant itself eventarc.messageBuses.publish on a message bus, enabling direct event injection into all bound pipelines.
match (effective permission)
{
"action": "eventarc.messageBuses.setIamPolicy",
"resource_type": "google.cloud.eventarc.v1.MessageBus"
}
emit
| source type | Identity |
|---|---|
| target type | Policy |
| source | <principal> |
| target | <message bus IAM allow policy> |
| permissions | eventarc.messageBuses.setIamPolicy |
| conditions | iam_permission scp_or_org_policy |
| state logic | ACTIVE when the principal holds eventarc.messageBuses.setIamPolicy on the message bus. A self-grant of eventarc.messageBuses.publish (via CanModifyPolicy → CanGrantPermission) enables the principal to write events to the bus. CONDITIONAL when org policy or IAM deny may block self-grants (constraints/iam.allowedPolicyMemberDomains). BLOCKED when an IAM deny or org policy denies eventarc.messageBuses.setIamPolicy itself. |
Narrative
{principal.name} can set the IAM policy of message bus {bus.name} (eventarc.messageBuses.setIamPolicy), granting itself eventarc.messageBuses.publish and enabling event injection into all pipelines bound to the bus.
Raw rule rules/derived/gcp/eventarc.yaml
id: gcp-eventarc-set-bus-iam-policy
emits: CanModifyPolicy
description: eventarc.messageBuses.setIamPolicy lets an attacker grant itself eventarc.messageBuses.publish
on a message bus, enabling direct event injection into all bound pipelines.
match_effective_permission:
action: eventarc.messageBuses.setIamPolicy
resource_type: google.cloud.eventarc.v1.MessageBus
emit:
source_type: Identity
target_type: Policy
source: <principal>
target: <message bus IAM allow policy>
permissions:
- eventarc.messageBuses.setIamPolicy
conditions:
- iam_permission
- scp_or_org_policy
state_logic: "ACTIVE when the principal holds eventarc.messageBuses.setIamPolicy on the message bus.\
\ A self-grant of eventarc.messageBuses.publish (via CanModifyPolicy \u2192 CanGrantPermission) enables\
\ the principal to write events to the bus. CONDITIONAL when org policy or IAM deny may block self-grants\
\ (constraints/iam.allowedPolicyMemberDomains). BLOCKED when an IAM deny or org policy denies eventarc.messageBuses.setIamPolicy\
\ itself."
derived_from:
- 'effective permission: eventarc.messageBuses.setIamPolicy on the message bus resource'
false_positive_note: setIamPolicy on the message bus grants the principal control over who may publish
to it. A self-grant of eventarc.messageBuses.publish via a subsequent CanGrantPermission edge completes
the escalation. Org policy constraints/iam.allowedPolicyMemberDomains may block the self-grant even
if setIamPolicy succeeds. Validate that active pipelines with live consumers exist on the bus before
claiming CanExecuteAs via event injection.
narrative: '{principal.name} can set the IAM policy of message bus {bus.name} (eventarc.messageBuses.setIamPolicy),
granting itself eventarc.messageBuses.publish and enabling event injection into all pipelines bound
to the bus.'