Derivation rules

eventarc.triggers.create/update lets an attacker bind a new event source (Pub/Sub topic, Audit Log, GCS event) to the workflow - the event-source-binding creation primitive.

workflows.executions.create starts a new execution with a caller-supplied argument payload - both a direct invoke AND a publish-to-topic primitive (feeds messaging-chains rule 1).

Create a new workflow bound to a passable SA (create + actAs) to execute code as that SA.

An IAM binding on the workflow's allow policy granting workflows.executions.create to a principal in a different project is cross-project publish/trigger trust.

A workflow execution's argument payload may carry secrets passed by the caller; visible in execution metadata to anyone with executions.get.

Any code running inside a workflow (via definition control) can exfiltrate the runtime SA token via an outbound http.request step to an attacker-controlled endpoint.

actAs on a SA that the principal can attach to a workflow (create/update) is the GCP PassRole analog for Workflows.

An IAM binding granting roles/workflows.invoker to allUsers or allAuthenticatedUsers makes the workflow internet-invocable.

workflows.workflows.setIamPolicy lets an attacker grant itself roles/workflows.editor (CanModifyCode path) or roles/workflows.invoker (CanInvoke path) on the workflow.

workflows.workflows.get returns the full workflow definition source, which may embed hardcoded credentials, API keys, or connection strings in step parameters.

workflows.workflows.update can also re-point the runtime SA (serviceAccount field) when paired with actAs; configuration change path to CanExecuteAs.

workflows.workflows.update replaces the workflow's YAML/JSON definition, enabling injection of arbitrary Google API calls or HTTP steps that run as the runtime SA.

Ability to assign roles/permissions at a boundary scope lets the principal self-grant full control of that boundary and, by inheritance, its whole subtree.

A principal who can modify or escape a guardrail (SCP / Org Policy / deny assignment) upgrades the edges that guardrail was suppressing from BLOCKED to their underlying state.

Pushing/overwriting an image in a registry poisons every workload that pulls it - code control propagates from the registry to each consuming Compute/KubernetesWorkload.

Impersonating a strictly-more-privileged identity is privilege escalation.

Publishing/sending to an event source triggers the consumer bound to it (via an event-source-mapping/subscription/rule target) with an attacker-influenced payload.

A messaging resource policy that grants publish/subscribe to a principal in another account is cross-account trust (Pub/Sub topic IAM across projects emits CrossProjectTrust); feeds can-control's CanEnter* roll-up.

Creating a schedule/rule that invokes a target as a passed execution identity is persistence and yields execution as that identity.

Triggering an event-driven consumer that executes as an identity runs the attacker-influenced payload as that identity (generic messaging case; CI/CD runners are cicd-chains').

A resource exposed to the internet is reachable by any internet (anonymous) principal - the external network entry point that seeds internet-origin attack paths.

An internet principal that can reach an internet-facing load balancer can also reach the LB's backend targets - composing internet-entry with LB-to-backend forwarding.

A source co-located with the destination in the same Subnet reaches it when the destination's SG/NSG/firewall admits the source segment on a listening port.

A source reaches a destination across a SINGLE VPC/VNet peering when the destination's ingress admits it - peering is non-transitive, so exactly one direct hop.

A private-link/PSC/private-endpoint path makes a PaaS/data/storage service reachable to an in-network consumer, often across account/project boundaries without internet exposure.

A source whose subnet routes to the destination's subnet (intra-VPC/VNet routing) reaches the destination when its ingress rule admits the source.

A source reaches a destination through a shared transit hub (Transit Gateway/VWAN/NCC/Direct Connect gateway/VPN gateway) that forwards between attachments - transitive across the hub's associated route table.

A workload poisoned via a registry image push runs as its identity, so the pusher executes as that identity.

Reading a credential that is credentials for an identity yields the ability to authenticate as that identity.

Reading a secret that is credentials for an identity yields the ability to authenticate as that identity.

Signing tokens as an identity yields impersonation when a downstream trust validates those signatures.

A Kubernetes workload-identity binding (KSA<->GSA / IRSA / AKS Workload Identity) lets the pod's projected SA token federate into a cloud Role/ServiceAccount; escalation roll-ups are federation-chains'.