gcp-eventarc-trigger-routes-to-consumer

id: gcp-eventarc-trigger-routes-to-consumer
emits: CanTrigger
description: "A live Eventarc trigger (state=ACTIVE) routes events from its source to the destination\
  \ consumer \u2014 the event-source-binding fact feeding messaging-chains rules 1 and 2."
match_record:
  resource_type: google.cloud.eventarc.v1.Trigger
  field: destination
where:
- trigger.state == ACTIVE
- 'trigger.destination is set to one of: cloudRun, workflow, gke, cloudFunction, httpEndpoint (Eventarc
  Advanced)'
emit:
  source_type: EventRule
  target_type: Compute
  source: <Eventarc trigger (EventRule)>
  target: <destination consumer (Cloud Run service / Workflow / Cloud Function / GKE workload)>
  permissions: []
  conditions:
  - trigger_exists
  - service_state
  state_logic: ACTIVE when trigger.state == ACTIVE and the destination resource is deployed and reachable
    by the trigger SA (trigger SA holds the required invoker role on the destination). CONDITIONAL(service_state)
    when the trigger is ACTIVE but the destination is not deployed/enabled. CONDITIONAL(condition_expression)
    when the trigger has narrow event filters that may not be satisfiable by an attacker payload (honor
    filter specificity). BLOCKED when trigger.state == FAILED or PROVISIONING.
  derived_from:
  - trigger.destination field + trigger.state == ACTIVE
  false_positive_note: "Always gate on trigger.state == ACTIVE. A FAILED trigger does not deliver events.\
    \ Event filters (Cloud Audit Log service/method/resource, Pub/Sub message attribute filters) constrain\
    \ which events fire \u2014 downgrade to CONDITIONAL(condition_expression) when the attacker cannot\
    \ craft a matching event. The trigger SA must hold the appropriate invoker role on the destination;\
    \ without it event delivery fails (404 or 403 from the destination). This edge is consumed by messaging-chains\
    \ rule 1 (when combined with CanWriteData on the source) to derive CanTrigger(publisher \u2192 consumer),\
    \ and by rule 2 with ExecutesAs (from the destination's rule file) to derive CanExecuteAs."
  narrative: Eventarc trigger {trigger.name} (state=ACTIVE) routes events to {consumer.name}. Any principal
    or source that causes a matching event fires {consumer.name} to execute with the delivered event payload.