EventRule

pipes:CreatePipe + iam:PassRole lets a principal create an EventBridge Pipe with a chosen target and execution role - a persistent source-to-target data flow.

pipes:UpdatePipe lets a principal change an existing Pipe's target, enrichment, source filter, or execution role - re-routing or re-escalating persistent data flow.

events:PutRule + events:PutTargets on a bus lets a principal create/modify rules and set invocation targets and roles - a rule-based persistence and trigger creation primitive.

An EventBridge rule assumes its invocation RoleArn (via events.amazonaws.com) to call targets that require IAM authorization; code running as that rule effectively runs as the invocation role.

A firing EventBridge rule invokes its configured target (Lambda, Step Functions, ECS, SQS, another bus, etc.) with the event payload.

Creating or updating an EventBridge rule that targets a Step Functions state machine is persistence: it fires on a schedule/event pattern, starting executions without further attacker action.

An EventBridge rule with a Step Functions state machine as its target can start an execution when the rule matches; the EventBridge source is the event source, the state machine is the consumer.

sns:Subscribe lets an attacker create a new subscription (EventRule binding) on the topic, routing future publishes to a chosen Lambda or SQS endpoint.

A confirmed active SNS subscription binds the topic to its consumer; every Publish invokes the consumer with the message payload.

A principal with read access to an Event Grid subscription's dead-letter destination (Storage blob container) can read all failed/expired event payloads, including any credential material they contain.

An active Event Grid event subscription binds a topic to a Compute consumer (Azure Function, Logic App, webhook); this is the CanTrigger fact consumed by messaging-chains rule 1.

eventarc.triggers.create lets an attacker bind any reachable event source to any destination consumer as an Eventarc trigger - the event-source-binding creation primitive (Phase-10 CanSchedule).

Create a new Eventarc trigger binding an event source to a destination consumer, then publish an event (or wait for a natural event) to run the consumer as its runtime SA. Provides the Eventarc-specific framing of messaging-chains rule 2.

Update an existing Eventarc trigger's destination to point at attacker-controlled or higher-privilege compute, then wait for a natural event to fire, gaining execution as the new destination's runtime SA.

An Eventarc trigger uses its serviceAccount field as the delivery identity when calling the destination endpoint.

The Eventarc-managed Pub/Sub transport topic backs the trigger's event delivery - connects Topic node to EventRule node for the two-hop chain.

An Eventarc trigger has an IAM allow policy governing who may manage it.

Live Eventarc trigger (state=ACTIVE) routes events to a Cloud Run service destination.

Live Eventarc trigger (state=ACTIVE) routes events to a Cloud Function destination.

Live Eventarc trigger (state=ACTIVE) routes events to a GKE service endpoint.

Live Eventarc trigger (state=ACTIVE) routes events to a GCP Workflow destination.

A live Eventarc trigger (state=ACTIVE) routes events from its source to the destination consumer - the event-source-binding fact feeding messaging-chains rules 1 and 2.

eventarc.triggers.update can redirect an existing trigger's destination, swap the trigger SA, or widen event filters - hijacking a live event stream to an attacker-chosen consumer or re-activating a previously-filtered trigger path.

eventarc.triggers.create/update lets an attacker bind a new event source (Pub/Sub topic, Audit Log, GCS event) to the workflow - the event-source-binding creation primitive.

Creating a schedule/rule that invokes a target as a passed execution identity is persistence and yields execution as that identity.