aws-apigw-invoke-executes-as

id: aws-apigw-invoke-executes-as
emits: CanExecuteAs
description: Invoking an API Gateway API whose integration ExecutesAs a credentials role runs the integration
  as that role, yielding CanExecuteAs.
match:
- - principal: null
  - CanInvoke
  - api: null
- - api: null
  - ExecutesAs
  - role: null
where:
- node_type(?api) == APIGateway
- ?role is the integration credentials role (IAM role ARN in integration.credentials, not caller-creds
  passthrough)
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?role
  permissions:
  - execute-api:Invoke
  conditions:
  - iam_permission
  - resource_policy
  state_logic: "ACTIVE when the principal has effective execute-api:Invoke on the API's stage/method scope\
    \ (identity policy allows it AND the resource policy allows it \u2014 both must allow for cross-account;\
    \ same-account requires only one). CONDITIONAL(resource_policy) when the resource policy gate is unclear.\
    \ BLOCKED when a Deny in the resource policy or an SCP/permission-boundary denies execute-api:Invoke."
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - ?principal CanInvoke ?api
  - ?api ExecutesAs ?role (integration credentials)
  false_positive_note: "This rule applies ONLY when the API's integration ExecutesAs a credentials role\
    \ (the explicit rule aws-apigw-executesas-credentials-role was triggered). A Lambda proxy integration\
    \ WITHOUT a credentials role does NOT yield this rule \u2014 the Lambda's own execution role is a\
    \ separate ExecutesAs on the Lambda node, reached via rule 2 and messaging-chains. Honor the scope\
    \ of execute-api:Invoke (stage and method/route path in the resource ARN); a grant scoped to one route\
    \ does not yield all-routes execution. An SCP or permission boundary denying execute-api:Invoke blocks\
    \ this."
  narrative: "{principal.name} can invoke {api.name} (execute-api:Invoke), which has an integration that\
    \ runs as IAM role {role.name} (integration.credentials). Invoking the API causes API Gateway to assume\
    \ {role.name} and execute the integration as that role \u2014 effectively running as {role.name}."