Topic

A firing EventBridge rule invokes its configured target (Lambda, Step Functions, ECS, SQS, another bus, etc.) with the event payload.

sns:Subscribe lets an attacker create a new subscription (EventRule binding) on the topic, routing future publishes to a chosen Lambda or SQS endpoint.

sns:SetTopicAttributes can modify topic configuration including KmsMasterKeyId (SSE), DeliveryPolicy, SignatureVersion, etc., enabling data-exposure and delivery attacks.

sns:SetTopicAttributes (Policy attribute) or sns:AddPermission rewrites or extends the SNS topic access policy, enabling self-grant of Publish/Subscribe or cross-account trust.

A principal with effective sns:Publish on an SNS topic can send messages to it, potentially triggering all bound subscribers.

sns:Subscribe lets an attacker add their own endpoint as a subscriber and receive all messages published to the topic, including embedded secrets.

A confirmed active SNS subscription binds the topic to its consumer; every Publish invokes the consumer with the message payload.

An SNS topic without a DataProtectionPolicy may carry messages embedding secrets; any subscriber can read them (POTENTIAL - content heuristic, not confirmed).

An SNS topic access policy granting sns:Publish to Principal '*' is internet-accessible - anyone can publish and trigger all subscribers.

A Service Bus topic with active entity-level SAS authorization rules embeds topic-scoped connection-string credentials usable at data-plane without Entra RBAC.

A confirmed event-source binding from a Service Bus topic subscription to a compute consumer - fan-out trigger fact.

A principal with pubsub.topics.publish on a trigger's configured Pub/Sub topic can fire that trigger, potentially executing code as the trigger's SA.

A Cloud Scheduler Pub/Sub job targeting a topic in a different project establishes cross-project trust - the Cloud Scheduler service agent must hold roles/pubsub.publisher in the external project.

The Eventarc-managed Pub/Sub transport topic backs the trigger's event delivery - connects Topic node to EventRule node for the two-hop chain.

pubsub.topics.publish on the Eventarc-managed transport Pub/Sub topic lets an attacker inject crafted CloudEvent messages directly into the Eventarc delivery pipeline, bypassing the standard source adapter.

Publishing to an Eventarc-managed Pub/Sub transport topic directly triggers the bound destination consumer - collapses the Topic → EventRule → Compute chain into a single CanTrigger(Topic → Compute) for messaging-chains rule 1.

pubsub.topics.publish on a topic is the data-plane publish action; the principal can send attacker-influenced messages that drive push-subscription consumers. Consumed by messaging-chains as CanWriteData(principal → topic).

pubsub.topics.setIamPolicy allows rewriting the topic IAM policy, enabling self-grant of pubsub.topics.publish and the downstream trigger chain.

allUsers or allAuthenticatedUsers granted pubsub.topics.publish on a topic makes it publicly writable; any internet caller can trigger bound push-subscription consumers via messaging-chains without project credentials.