messaging-resource-policy-cross-boundary-trust

A messaging resource policy that grants publish/subscribe to a principal in another account is cross-account trust (Pub/Sub topic IAM across projects emits CrossProjectTrust); feeds can-control's CanEnter* roll-up.

derived any cloud emits CrossAccountTrust

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'msgpolicy': None} HasPolicy {'src': None}

where

node_class(?src) in [Messaging, Storage] node_type(?msgpolicy) == ResourcePolicy policy names a principal whose account/project/tenant != owner(?src)

emit

source type	`ResourcePolicy`
target type	`Account`
source	`?msgpolicy`
target	`<external account/project/tenant named in the messaging policy>`
conditions	`resource_policy` `condition_expression`
state logic	ACTIVE when the messaging resource policy unconditionally grants a cross-boundary send/subscribe to a named external principal. CONDITIONAL(condition_expression) when scoped by a condition the external principal must satisfy (aws:SourceArn / aws:SourceAccount / aws:PrincipalOrgID on the statement, a Pub/Sub IAM condition, a SAS scope). BLOCKED by an SCP/org-policy/deny that neutralizes the grant. On GCP this same collapse emits CrossProjectTrust (Project target) rather than CrossAccountTrust — emit the provider-appropriate cross-boundary edge.

Narrative

The resource policy on the messaging source {src.name} grants a principal in another account/project publish/subscribe access; this cross-boundary trust lets that external principal drive {src.name} (and, via its bound consumers, execution inside {src.name}'s boundary - can-control rolls that up to CanEnter*).

Raw rule rules/derived/messaging-chains.yaml

id: messaging-resource-policy-cross-boundary-trust
emits: CrossAccountTrust
description: A messaging resource policy that grants publish/subscribe to a principal in another account
  is cross-account trust (Pub/Sub topic IAM across projects emits CrossProjectTrust); feeds can-control's
  CanEnter* roll-up.
applies_to:
- '*'
match:
- - msgpolicy: null
  - HasPolicy
  - src: null
where:
- node_class(?src) in [Messaging, Storage]
- node_type(?msgpolicy) == ResourcePolicy
- policy names a principal whose account/project/tenant != owner(?src)
emit:
  source_type: ResourcePolicy
  target_type: Account
  source: ?msgpolicy
  target: <external account/project/tenant named in the messaging policy>
  permissions: []
  conditions:
  - resource_policy
  - condition_expression
  state_logic: "ACTIVE when the messaging resource policy unconditionally grants a cross-boundary send/subscribe\
    \ to a named external principal. CONDITIONAL(condition_expression) when scoped by a condition the\
    \ external principal must satisfy (aws:SourceArn / aws:SourceAccount / aws:PrincipalOrgID on the statement,\
    \ a Pub/Sub IAM condition, a SAS scope). BLOCKED by an SCP/org-policy/deny that neutralizes the grant.\
    \ On GCP this same collapse emits CrossProjectTrust (Project target) rather than CrossAccountTrust\
    \ \u2014 emit the provider-appropriate cross-boundary edge."
  confidence: min(contributing_confidences)
  derived_from:
  - ?msgpolicy HasPolicy ?src (cross-boundary send/subscribe grant)
  false_positive_note: "CITE, DO NOT DUPLICATE can-control: this rule asserts ONLY the cross-boundary\
    \ messaging TRUST \u2014 it does NOT emit CanEnter*. The CanEnterAccount/Project/Tenant consequence\
    \ (cross-boundary publish -> trigger consumer in the target boundary -> foothold) is produced by can-control\
    \ (enter-account-via-assume and its analogs) consuming this CrossAccountTrust/CrossProjectTrust together\
    \ with rules 1-2's CanTrigger/CanExecuteAs; never re-derive it here. Honor SourceArn/SourceAccount/\
    \ PrincipalOrgID scoping \u2014 a policy that only trusts a specific sibling account is not open cross-account\
    \ access (downgrade to CONDITIONAL). A publish-only grant that reaches NO consumer in the target boundary\
    \ is trust without an entry path \u2014 do not let downstream infer entry unless a binding (rule 1)\
    \ actually routes to compute. Wildcard-Principal publish is internet/tenant exposure (ExposedToInternet/\
    \ ExposedToTenant), emitted by the network rules, not this cross-account edge."
  narrative: "The resource policy on the messaging source {src.name} grants a principal in another account/project\
    \ publish/subscribe access; this cross-boundary trust lets that external principal drive {src.name}\
    \ (and, via its bound consumers, execution inside {src.name}'s boundary \u2014 can-control rolls that\
    \ up to CanEnter*)."