gcp-pubsub-publish-can-write-data

id: gcp-pubsub-publish-can-write-data
emits: CanWriteData
description: "pubsub.topics.publish on a topic is the data-plane publish action; the principal can send\
  \ attacker-influenced messages that drive push-subscription consumers. Consumed by messaging-chains\
  \ as CanWriteData(principal \u2192 topic)."
match:
- match_effective_permission:
    action: pubsub.topics.publish
    resource_type: google.pubsub.Topic
emit:
  source_type: Identity
  target_type: Topic
  source: <principal>
  target: <Pub/Sub topic node>
  permissions:
  - pubsub.topics.publish
  conditions:
  - iam_permission
  - resource_policy
  state_logic: ACTIVE when the effective pubsub.topics.publish is granted (topic IAM + project/ folder/org
    IAM all allow; no IAM deny policy denies). CONDITIONAL(resource_policy) when a topic IAM condition
    (e.g. request.time, resource.name) scopes the grant and the condition is not unconditionally satisfied.
    BLOCKED by an IAM deny policy or org policy that denies the action at effective scope.
  confidence: 0.97
  derived_from:
  - 'effective-permission: pubsub.topics.publish on topic'
  false_positive_note: "GCP Pub/Sub uses a unified IAM model: effective publish permission is the union\
    \ of grants at topic / project / folder / org minus any IAM deny policies. Honor IAM deny policies\
    \ (they win over allow). pubsub.topics.publish does NOT require the publisher to also hold pubsub.subscriptions.create\
    \ \u2014 the publisher only writes messages; consumers independently subscribe. A publisher cannot\
    \ suppress or read messages on a subscription it did not create."
  narrative: '{principal.name} can publish messages to Pub/Sub topic {topic.name} (pubsub.topics.publish),
    enabling the Phase-10 trigger chain when {topic.name} has an active push subscription bound to a compute
    consumer.'