gcp-eventarc-update-trigger

id: gcp-eventarc-update-trigger
emits: CanModifyConfiguration
description: "eventarc.triggers.update can redirect an existing trigger's destination, swap the trigger\
  \ SA, or widen event filters \u2014 hijacking a live event stream to an attacker-chosen consumer or\
  \ re-activating a previously-filtered trigger path."
match_effective_permission:
  action: eventarc.triggers.update
  resource_type: google.cloud.eventarc.v1.Trigger
emit:
  source_type: Identity
  target_type: EventRule
  source: <principal>
  target: <Eventarc trigger in scope>
  permissions:
  - eventarc.triggers.update
  conditions:
  - iam_permission
  state_logic: "ACTIVE when the principal holds eventarc.triggers.update on the trigger resource. The\
    \ downstream capability (redirect to attacker destination) requires additionally: actAs on the new\
    \ trigger SA (if changing serviceAccount) AND the trigger SA having invoker rights on the new destination\
    \ \u2014 gate the resulting CanTrigger redirect at POTENTIAL(role_compatibility) when those are unconfirmed.\
    \ Filter widening (removing eventFilters entries) may upgrade a CONDITIONAL(condition_expression)\
    \ CanTrigger to ACTIVE."
  derived_from:
  - 'effective permission: eventarc.triggers.update on the trigger resource'
  false_positive_note: "Three distinct attack vectors from trigger update: (1) destination redirect \u2014\
    \ swap trigger.destination to attacker-controlled Cloud Run / Workflow; requires trigger SA invoker\
    \ rights on the new destination (POTENTIAL if unconfirmed). (2) trigger SA swap \u2014 change trigger.serviceAccount\
    \ to an attacker-actAs-able SA; requires actAs on the new SA. (3) event filter widening \u2014 remove\
    \ restrictive eventFilters to let more events through (the underlying event source may already fire\
    \ the trigger more broadly, upgrading CONDITIONAL to ACTIVE). Model the downstream escalation as CONDITIONAL\
    \ or POTENTIAL depending on which sub-vector applies and whether the actAs/invoker gates are satisfied."
  narrative: '{principal.name} can update the Eventarc trigger {trigger.name} (eventarc.triggers.update),
    redirecting its event stream to an attacker-chosen destination, widening event filters, or swapping
    the delivery SA.'