gcp-workflows-create-eventarc-trigger

id: gcp-workflows-create-eventarc-trigger
emits: CanSchedule
description: "eventarc.triggers.create/update lets an attacker bind a new event source (Pub/Sub topic,\
  \ Audit Log, GCS event) to the workflow \u2014 the event-source-binding creation primitive."
match_effective_permission:
  action: eventarc.triggers.create
  resource_type: google.cloud.eventarc.v1.Trigger
alt_permission: eventarc.triggers.update
where:
- trigger.destination.workflow points to a Workflow resource in scope
- principal has iam.serviceAccounts.actAs on the Eventarc trigger's service account
emit:
  source_type: Identity
  target_type: EventRule
  source: <principal>
  target: <Eventarc trigger / EventRule>
  permissions:
  - eventarc.triggers.create
  - eventarc.triggers.update
  - iam.serviceAccounts.actAs
  derived_from:
  - 'effective permission: eventarc.triggers.create/update, iam.serviceAccounts.actAs on trigger SA'
  conditions:
  - role_compatibility
  - iam_permission
  state_logic: ACTIVE when the principal holds eventarc.triggers.create (or .update) AND iam.serviceAccounts.actAs
    on the Eventarc trigger SA (needed to configure the trigger's invocation identity). POTENTIAL(role_compatibility)
    when actAs on the trigger SA is unknown/unresolved. This CanSchedule feeds messaging-chains rule 3
    (messaging-schedule-persists-executes-as) when the trigger also passes an identity to the invocation
    target.
  false_positive_note: 'Creating an Eventarc trigger requires actAs on the trigger''s own service account
    (the SA Eventarc uses to call workflows.executions.create). This is a separate SA from the workflow''s
    runtime SA. The attack chain: create trigger (this edge) -> trigger fires -> workflow runs as its
    runtime SA (CanTrigger -> ExecutesAs -> CanExecuteAs, rolled up by messaging-chains). Honor actAs
    scope: actAs on one SA does NOT grant actAs on another.'
  narrative: '{principal.name} can create/update an Eventarc trigger (eventarc.triggers.create + iam.serviceAccounts.actAs
    on trigger SA) that binds an event source to {workflow.name}, establishing persistent event-driven
    execution as the workflow''s runtime service account.'