gcp-gcs-write-triggers-function
An object write to a GCS bucket with Pub/Sub notification config pointing to a Cloud Function/Cloud Run service triggers downstream compute execution as the function's service account.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?bucket has a Pub/Sub notification config targeting ?function (Cloud Function or Cloud Run service)
notification is configured to fire on object-create events
emit
| source type | Identity |
|---|---|
| target type | ServerlessFunction |
| source | ?principal |
| target | ?function |
| permissions | storage.objects.create |
| conditions | iam_permission trigger_exists |
| state logic | ACTIVE when CanWriteData(?principal, ?bucket) is ACTIVE AND the bucket's Pub/Sub notification config targeting ?function is confirmed active; CONDITIONAL(trigger_exists) when the notification config is not confirmed or the Cloud Function/Cloud Run target state is unknown; BLOCKED if the notification config is removed or the target service is disabled. Note: the attacker's privilege level during function execution is determined by the function's ExecutesAs service account (modeled by gcp/gcf.yaml or gcp/cloudrun.yaml). |
Narrative
{principal.name} can write objects to {bucket.name}; the bucket is configured with a Pub/Sub notification pointing to {function.name}, which fires on object creation. Writing an object will trigger {function.name} to execute.
Raw rule rules/derived/gcp/gcs.yaml
id: gcp-gcs-write-triggers-function
emits: CanTrigger
description: An object write to a GCS bucket with Pub/Sub notification config pointing to a Cloud Function/Cloud
Run service triggers downstream compute execution as the function's service account.
match:
- - principal: null
- CanWriteData
- bucket: null
- - bucket: null
- CanTrigger
- function: null
where:
- ?bucket has a Pub/Sub notification config targeting ?function (Cloud Function or Cloud Run service)
- notification is configured to fire on object-create events
emit:
source_type: Identity
target_type: ServerlessFunction
source: ?principal
target: ?function
permissions:
- storage.objects.create
conditions:
- iam_permission
- trigger_exists
state_logic: 'ACTIVE when CanWriteData(?principal, ?bucket) is ACTIVE AND the bucket''s Pub/Sub notification
config targeting ?function is confirmed active; CONDITIONAL(trigger_exists) when the notification
config is not confirmed or the Cloud Function/Cloud Run target state is unknown; BLOCKED if the notification
config is removed or the target service is disabled. Note: the attacker''s privilege level during
function execution is determined by the function''s ExecutesAs service account (modeled by gcp/gcf.yaml
or gcp/cloudrun.yaml).'
confidence: min(contributing_confidences) * 0.85
derived_from:
- ?principal CanWriteData ?bucket
- ?bucket notification config targeting ?function
false_positive_note: "Object-write triggers are event-driven: only object-creation events fire the notification\
\ (not object deletes, updates, or metadata changes \u2014 unless explicitly configured). The exact\
\ event filter and destination must be confirmed in the bucket's notificationConfig field. CanTrigger\
\ here is a CAPABILITY (the write fires the trigger); downstream execution privilege is separate and\
\ depends on the function's ExecutesAs role (cite can-execute-as). A bucket with multiple notification\
\ configs may trigger multiple downstream services \u2014 emit a CanTrigger edge for each. VPC-SC\
\ perimeters that co-perimeter the bucket and Pub/Sub may allow the trigger; perimeters that exclude\
\ Pub/Sub or target functions may block it -> CONDITIONAL(trigger_exists)."
narrative: '{principal.name} can write objects to {bucket.name}; the bucket is configured with a Pub/Sub
notification pointing to {function.name}, which fires on object creation. Writing an object will trigger
{function.name} to execute.'