aws-apigw-api-triggers-lambda

id: aws-apigw-api-triggers-lambda
emits: CanTrigger
description: An API Gateway API that invokes a Lambda backend is an event source for that Lambda; invoking
  the API triggers the Lambda.
match:
- - api: null
  - CanInvoke
  - lambda: null
where:
- node_type(?api)    == APIGateway
- node_type(?lambda) == ServerlessFunction
emit:
  source_type: APIGateway
  target_type: Compute
  source: ?api
  target: ?lambda
  permissions: []
  conditions:
  - trigger_exists
  - service_state
  state_logic: ACTIVE when the Lambda integration is configured and enabled (the route/method is deployed
    in a stage, the Lambda resource policy grants invoke to API Gateway). CONDITIONAL(trigger_exists)
    when the integration exists but the route is not yet deployed to a stage. BLOCKED when the Lambda
    resource policy does not allow apigateway.amazonaws.com to invoke it.
  confidence: min(contributing_confidences)
  derived_from:
  - ?api CanInvoke ?lambda
  false_positive_note: "This CanTrigger(api -> lambda) feeds messaging-chains rule 1: any principal with\
    \ CanInvoke(?principal, ?api) + this CanTrigger(?api, ?lambda) yields CanTrigger(?principal, ?lambda)\
    \ [messaging-publish-triggers-consumer]. Then messaging-chains rule 2 + ExecutesAs(?lambda, ?role)\
    \ => CanExecuteAs(?principal, ?role) [messaging-trigger-executes-as] \u2014 the canonical Phase-10\
    \ path. Do NOT also derive CanExecuteAs here directly; that is the linchpin's job. Only emit when\
    \ the Lambda resource policy actually grants lambda:InvokeFunction to apigateway.amazonaws.com with\
    \ a matching aws:SourceArn or aws:SourceAccount condition (or no condition for overly permissive policies).\
    \ A disabled/unconfigured integration or a Lambda function whose resource policy does not authorize\
    \ this API produces CONDITIONAL, not ACTIVE."
  narrative: API Gateway API {api.name} invokes Lambda function {lambda.name} on each matched request;
    {api.name} is an event source (trigger) for {lambda.name}. Any principal that can invoke this API
    thereby triggers {lambda.name} to run.