Derivation rules

A consumer-account VPC with a confirmed (state==available) attachment to an owner-account Transit Gateway has L3 network reachability to subnets in the owner account (subject to TGW route table routing and L4 security group evaluation). This is a network-layer foothold (CanNetworkReach), not control-plane account entry (CanEnterAccount).

A VPC endpoint policy (gateway or interface) granting access to principals in another AWS account enables cross-account access to the backing PaaS service via the endpoint path. The endpoint policy resource is the trust artifact (modeled as ResourcePolicy source).

vpc-lattice:PutAuthPolicy lets a principal replace the auth policy on a service or service network, potentially opening services to unauthorized callers (remove org restriction, set Principal:*, disable auth type).

scopeMaps/write allows a principal to modify repository-scoped token access policies, upgrading restricted tokens to include push/write capability.

An Event Grid topic exposes its access key to any principal who can call listKeys/action; the key is a long-lived publish credential for the topic.

A customer principal with Microsoft.ManagedServices/registrationAssignments/write can create/modify Lighthouse registrationAssignments - enable cross-tenant access.

An identity with <resource>/privateEndpointConnections/write on a PaaS resource can approve a private endpoint connection from a different subscription. Approving such a connection records a cross-subscription trust: the resource owner has explicitly authorized a network connection from another subscription's VNet, extending the reach of that remote VNet across the subscription boundary.

An Approved private endpoint connection from a different subscription records an authorization relationship: the resource owner (in the provider subscription) has approved a network connection from an external (consumer) subscription. This models the cross-subscription trust relationship established by the approval.

A Service Bus namespace with active SAS authorization rules embeds connection-string credentials usable at data-plane without Entra RBAC.

A Service Bus queue with active entity-level SAS authorization rules embeds queue-scoped connection-string credentials usable at data-plane without Entra RBAC.

A Service Bus topic with active entity-level SAS authorization rules embeds topic-scoped connection-string credentials usable at data-plane without Entra RBAC.

An Artifact Registry repo IAM allow policy that grants roles/artifactregistry.writer (or uploadArtifacts) to a service account from a different GCP project establishes cross-project trust - that SA can push to this project's registry.

A principal that can set a repo's IAM policy can self-grant roles/artifactregistry.writer and then push, reaching CanModifyCode on the repo via policy manipulation.

artifactregistry.repositories.setIamPolicy grants full control over the repo's IAM allow policy - self-grant writer access, then push to poison consumers.

An Artifact Registry repo IAM binding for a Workload Identity Federation principalSet/principal with uploadArtifacts grants an external OIDC identity (e.g. GitHub Actions) direct push access - supply-chain from external CI into GCP workloads.

A Cloud Scheduler Pub/Sub job targeting a topic in a different project establishes cross-project trust - the Cloud Scheduler service agent must hold roles/pubsub.publisher in the external project.

An IAM binding on an Eventarc Advanced message bus granting eventarc.messageBuses.publish to a principal in a different project is cross-project event-injection trust - that external principal can drive all pipelines bound to the bus.

An IAM binding on an Eventarc trigger granting eventarc.triggers.update (or .create in the project) to a principal in a different project is cross-project trigger-management trust - that external principal can redirect the trigger or bind new sources to consumers in this project.

An IAM binding on an Eventarc Advanced message bus granting publish rights to a principal in a different project.

An IAM binding on an Eventarc trigger granting trigger management permissions to a principal in a different project.

GCR artifacts bucket grants storage.objects.create to a principal from another project - cross-project supply-chain trust allows external actors to inject images into this project's registry.

storage.buckets.setIamPolicy on the GCR artifacts bucket = rewrite the registry IAM policy, enabling cross-project push grants, public pull, or access revocation.

A cross-project principal that can set the bucket IAM policy can grant itself objectViewer, read the bucket contents, and enter the bucket's project data boundary - especially when the bucket contains privileged credentials.

A principal with CanModifyPolicy on a bucket's IAM policy can grant itself roles/storage.objectViewer or roles/storage.admin and read or administer its objects.

A Pub/Sub subscription IAM binding granting pubsub.subscriptions.consume to a principal from another GCP project enables the external principal to read/drain the subscription (data exfiltration via messaging-chains).

A Pub/Sub topic IAM binding granting pubsub.topics.publish to a principal from another GCP project is cross-project publish trust; feeds can-control's CanEnterProject derivation via messaging-chains.

A CSR repo IAM binding that grants source.repos.update to a service account from a different GCP project establishes cross-project trust - that SA can push to this project's repository and arm Cloud Build triggers.

A principal that can set the repo IAM policy can self-grant roles/source.writer and then push commits - policy manipulation yields the same CanModifyCode as a direct writer binding.

source.repos.setIamPolicy grants full control over the repository's IAM allow policy - self-grant roles/source.writer, then push to arm Cloud Build triggers.

A CSR repo IAM binding for a WIF principalSet/principal with source.repos.update grants an external OIDC identity (e.g. GitHub Actions) direct push access without any long-lived GCP key - supply-chain injection from external CI.

A Cloud Tasks queue IAM policy granting cloudtasks.tasks.create to a principal from another GCP project is cross-project messaging trust - the foreign principal can publish tasks to trigger the queue's consumer in the queue's project.

Principal holds notebooks.instances.setIamPolicy on a Workbench instance (explicit permission normalization).

An IAM binding on the workflow's allow policy granting workflows.executions.create to a principal in a different project is cross-project publish/trigger trust.

A messaging resource policy that grants publish/subscribe to a principal in another account is cross-account trust (Pub/Sub topic IAM across projects emits CrossProjectTrust); feeds can-control's CanEnter* roll-up.