gcp-eventarc-set-iam-policy

id: gcp-eventarc-set-iam-policy
emits: CanModifyPolicy
description: eventarc.triggers.setIamPolicy lets an attacker grant itself roles/eventarc.developer (trigger
  update/create) on the trigger, enabling destination redirect or filter widening.
match_effective_permission:
  action: eventarc.triggers.setIamPolicy
  resource_type: google.cloud.eventarc.v1.Trigger
emit:
  source_type: Identity
  target_type: Policy
  source: <principal>
  target: <trigger IAM allow policy>
  permissions:
  - eventarc.triggers.setIamPolicy
  derived_from:
  - 'effective permission: eventarc.triggers.setIamPolicy on the trigger resource'
  escalation: "Grant self roles/eventarc.developer \u2192 eventarc.triggers.update (CanModifyConfiguration)\
    \ \u2192 redirect destination or widen filters \u2192 CanTrigger (attacker consumer) \u2192 CanExecuteAs(consumer's\
    \ runtime SA). Or grant self trigger.create to bind new sources."
  false_positive_note: setIamPolicy on the trigger resource modifies only the trigger-level IAM policy.
    Project-level IAM deny policies or org policies that deny eventarc.triggers.update/create override
    a self-grant from the trigger policy. Check org policy and IAM deny before marking ACTIVE.
  narrative: '{principal.name} can set the IAM policy of trigger {trigger.name} (eventarc.triggers.setIamPolicy),
    granting itself update or create capabilities and completing a CanModifyConfiguration or CanSchedule
    escalation path.'