GCP's messaging services move data and trigger work, so access to them means reading other systems' events or injecting your own. Broad IAM on Pub/Sub lets you siphon a topic or publish forged messages, and Cloud Tasks queues can enqueue requests that call endpoints as a chosen service account.
What folds in here#
- Pub/Sub: reading or publishing to topics and subscriptions through broad IAM to capture or inject messages.
- Cloud Tasks: enqueuing requests that call endpoints or APIs as a chosen service account.