gcp-tasks-force-run-triggers-consumer
cloudtasks.tasks.run immediately force-dispatches an existing task to its configured consumer, bypassing schedule time and rate limits - a direct CanTrigger primitive that requires a suitable task to already exist in the queue.
match (effective permission)
{
"action": "cloudtasks.tasks.run",
"resource_type": "google.cloud.tasks.v2.Queue"
}
where
?queue is the Cloud Tasks queue in scope
?queue has
CanTrigger binding to ?consumer (the queue's httpTarget.uri consumer)
a task targeting ?consumer already exists in ?queue (confirmed via cloudtasks.tasks.list)
emit
| source type | Identity |
|---|---|
| target type | Compute |
| source | <principal> |
| target | <consumer> |
| permissions | cloudtasks.tasks.run |
| conditions | trigger_exists service_state |
| state logic | ACTIVE when: (a) the principal has effective cloudtasks.tasks.run on the queue, (b) a task targeting the consumer exists in the queue (confirmed from cloudtasks.tasks.list), and (c) the queue state is RUNNING or can be resumed. CONDITIONAL(trigger_exists) when no suitable task currently exists — the capability is real but requires a task to be present. POTENTIAL if the task existence is unconfirmed (partial collection). CONDITIONAL(service_state) for a PAUSED queue (need to also have cloudtasks.queues.resume or wait for resume). |
Narrative
{principal.name} has cloudtasks.tasks.run on {queue.name} and can immediately force-dispatch an existing task to {consumer.name}, bypassing schedule time and rate limits. If a task targeting {consumer.name} exists, this directly triggers the consumer.
Raw rule rules/derived/gcp/tasks.yaml
id: gcp-tasks-force-run-triggers-consumer
emits: CanTrigger
description: "cloudtasks.tasks.run immediately force-dispatches an existing task to its configured consumer,\
\ bypassing schedule time and rate limits \u2014 a direct CanTrigger primitive that requires a suitable\
\ task to already exist in the queue."
match_effective_permission:
action: cloudtasks.tasks.run
resource_type: google.cloud.tasks.v2.Queue
where:
- ?queue is the Cloud Tasks queue in scope
- ?queue has CanTrigger binding to ?consumer (the queue's httpTarget.uri consumer)
- a task targeting ?consumer already exists in ?queue (confirmed via cloudtasks.tasks.list)
emit:
source_type: Identity
target_type: Compute
source: <principal>
target: <consumer>
permissions:
- cloudtasks.tasks.run
conditions:
- trigger_exists
- service_state
state_logic: "ACTIVE when: (a) the principal has effective cloudtasks.tasks.run on the queue, (b) a\
\ task targeting the consumer exists in the queue (confirmed from cloudtasks.tasks.list), and (c)\
\ the queue state is RUNNING or can be resumed. CONDITIONAL(trigger_exists) when no suitable task\
\ currently exists \u2014 the capability is real but requires a task to be present. POTENTIAL if the\
\ task existence is unconfirmed (partial collection). CONDITIONAL(service_state) for a PAUSED queue\
\ (need to also have cloudtasks.queues.resume or wait for resume)."
derived_from:
- 'effective permission: cloudtasks.tasks.run on the queue'
- ?queue CanTrigger ?consumer (gcp-tasks-queue-dispatches-to-consumer)
false_positive_note: "cloudtasks.tasks.run dispatches an EXISTING task \u2014 it does NOT create a new\
\ task. If no suitable task (one targeting the consumer of interest) exists in the queue, this is\
\ POTENTIAL not ACTIVE. Do not conflate with cloudtasks.tasks.create. cloudtasks.tasks.run is independent\
\ from cloudtasks.tasks.create: a principal holding only roles/cloudtasks.taskRunner has tasks.run\
\ but NOT tasks.create. force-dispatch still delivers the existing task's body to the consumer; if\
\ the body is attacker-controlled (the attacker previously created the task), the trigger is meaningful.\
\ Dedupes with messaging-chains messaging-publish-triggers-consumer on (CanTrigger, ?principal, ?consumer)\
\ \u2014 emit once, preferring the force-run framing when tasks.run is the confirmed path."
narrative: '{principal.name} has cloudtasks.tasks.run on {queue.name} and can immediately force-dispatch
an existing task to {consumer.name}, bypassing schedule time and rate limits. If a task targeting
{consumer.name} exists, this directly triggers the consumer.'