gcp-workflows-create-execution

id: gcp-workflows-create-execution
emits:
- CanInvoke
- CanWriteData
description: "workflows.executions.create starts a new execution with a caller-supplied argument payload\
  \ \u2014 both a direct invoke AND a publish-to-topic primitive (feeds messaging-chains rule 1)."
match_effective_permission:
  action: workflows.executions.create
  resource_type: google.workflows.type.Workflow
emit:
- edge: CanInvoke
  source_type: Identity
  target_type: Workflow
  source: <principal>
  target: <workflow in scope>
  permissions:
  - workflows.executions.create
  derived_from:
  - 'effective permission: workflows.executions.create on the workflow resource'
  conditions:
  - iam_permission
  - service_state
  false_positive_note: "executions.create triggers an EXISTING workflow definition; it does NOT modify\
    \ the definition. The escalation consequence (CanExecuteAs the runtime SA) requires the existing definition\
    \ to run attacker-influenced input (the argument payload) \u2014 nearly always true for a data-processing\
    \ workflow, but a workflow that ignores its argument yields no execution leverage. State: ACTIVE when\
    \ the caller has executions.create AND the workflow is deployed/enabled."
  narrative: '{principal.name} can start a new execution of {workflow.name} (workflows.executions.create)
    with a caller-controlled argument payload, triggering steps that run as the runtime service account.'
- edge: CanWriteData
  source_type: Identity
  target_type: Messaging
  source: <principal>
  target: <workflow in scope>
  permissions:
  - workflows.executions.create
  derived_from:
  - 'effective permission: workflows.executions.create on the workflow resource'
  conditions:
  - iam_permission
  - service_state
  false_positive_note: workflows.executions.create is the publish/send primitive for the Workflow as an
    event source. This feeds messaging-chains rule 1 (CanWriteData + CanTrigger => CanTrigger at the consumer
    level).
  narrative: '{principal.name} can publish a message to {workflow.name} by creating an execution (workflows.executions.create)
    with an attacker-controlled argument payload.'