gcp-tasks-create-task-can-write-data

id: gcp-tasks-create-task-can-write-data
emits: CanWriteData
description: "cloudtasks.tasks.create enqueues a task with an attacker-controlled body to a Cloud Tasks\
  \ queue \u2014 the publish/send primitive that messaging-chains uses to derive CanTrigger(principal\
  \ \u2192 consumer)."
match_effective_permission:
  action: cloudtasks.tasks.create
  resource_type: google.cloud.tasks.v2.Queue
emit:
  source_type: Identity
  source: <principal>
  target: <Cloud Tasks queue in scope>
  permissions:
  - cloudtasks.tasks.create
  conditions:
  - iam_permission
  - service_state
  state_logic: ACTIVE when the principal has effective cloudtasks.tasks.create on the queue AND the queue
    state is RUNNING. CONDITIONAL(service_state) when the queue is PAUSED (tasks are accepted but not
    dispatched until resumed). Do not emit for DISABLED queues (tasks are rejected at the API level).
  derived_from:
  - 'effective permission: cloudtasks.tasks.create on the queue resource'
  false_positive_note: "A PAUSED queue accepts tasks but does not dispatch them \u2014 downgrade to CONDITIONAL(service_state).\
    \ A DISABLED queue rejects task creation entirely \u2014 do not emit. This CanWriteData feeds messaging-chains\
    \ rule 1 (messaging-publish-triggers-consumer) which derives CanTrigger(principal \u2192 consumer)\
    \ when a CanTrigger(queue \u2192 consumer) binding also exists. Do NOT emit CanExecuteAs here \u2014\
    \ that is messaging-chains + can-execute-as's job."
  narrative: "{principal.name} has cloudtasks.tasks.create on queue {queue.name} and can enqueue tasks\
    \ with attacker-controlled body and target parameters. This is the Phase-10 publish primitive: messaging-chains\
    \ combines this CanWriteData with the queue's event-source binding (CanTrigger) to derive CanTrigger(principal\
    \ \u2192 consumer)."