EventBus

An EventBridge custom bus resource policy granting events:PutEvents to a principal in another account establishes cross-account publish trust; the external principal can inject events that trigger compute consumers in this account.

An EventBridge custom bus policy granting events:PutEvents to Principal '*' is publicly writable; any internet actor can inject events and potentially trigger compute consumers.

events:PutEvents on a custom event bus lets a principal inject events that can match rules and trigger compute consumers.

events:PutPermission allows a principal to rewrite a custom bus resource policy, injecting cross-account trust or public access.

events:PutRule + events:PutTargets on a bus lets a principal create/modify rules and set invocation targets and roles - a rule-based persistence and trigger creation primitive.

A firing EventBridge rule invokes its configured target (Lambda, Step Functions, ECS, SQS, another bus, etc.) with the event payload.

An ADF Storage Events or Custom Events trigger binds a storage/Event Grid source to a pipeline; writing to that source drives the pipeline run.

Create a new event subscription on a topic or system topic, binding an event source to an attacker-controlled webhook endpoint.

An Event Grid topic exposes its access key to any principal who can call listKeys/action; the key is a long-lived publish credential for the topic.

Redirecting an event subscription's endpoint to an attacker-controlled webhook enables reading all event payloads from that topic (event exfiltration).

An active Event Grid event subscription binds a topic to a Compute consumer (Azure Function, Logic App, webhook); this is the CanTrigger fact consumed by messaging-chains rule 1.

Modify an existing event subscription's endpoint, redirecting all future events to an attacker-controlled webhook; enables event exfiltration and payload inspection.

Full control of an Event Grid topic (EventGrid Contributor / Contributor / Owner).

An Event Grid custom topic with publicNetworkAccess=Enabled is internet-accessible for event publishing (any holder of the topic key can publish from the internet).

An Eventarc Advanced message bus has an IAM allow policy governing who may publish to it.

Holding eventarc.messageBuses.publish on an Eventarc Advanced message bus lets an attacker inject arbitrary CloudEvents into the bus, driving all pipelines/enrollments bound to it - the direct Phase-10 publish primitive for Eventarc Advanced.