aws-appflow-admin

id: aws-appflow-admin
emits: CanAdminister
description: appflow:* grants full administrative control over all AppFlow flows and connector profiles
  in scope.
applies_to:
- aws
match_effective_permission:
  action: appflow:*
  resource_type: AWS::AppFlow::Flow
emit:
  source_type: Identity
  target_type: Messaging
  source: <principal>
  target: <AppFlow scope (all flows in account/region)>
  permissions:
  - appflow:*
  conditions:
  - iam_permission
  confidence: 0.95
  state_logic: ACTIVE when the evaluator confirms appflow:* at the effective scope (ideally Resource:*)
    with no SCP/boundary deny. The wildcard expands to include all constituent actions (UpdateFlow, CreateFlow,
    StartFlow, DeleteFlow, CreateConnectorProfile, UpdateConnectorProfile, DeleteConnectorProfile, UseConnectorProfile,
    DescribeFlows, DescribeFlowExecutionRecords, DescribeConnectorProfiles, etc.). When appflow:* on Resource:*
    is confirmed, treat CanModifyConfiguration, CanCreate, and CanWriteData on all flows/profiles as satisfied
    for downstream derivations. CONDITIONAL(iam_permission) when wildcard scope or expansion is unresolved.
  derived_from:
  - appflow:* effective permission (wildcard expansion via permission evaluator)
  false_positive_note: appflow:* on a scoped resource ARN (e.g. a specific flow ARN) does NOT grant CreateFlow
    on Resource:* (which only accepts Resource:*). The evaluator must expand the wildcard against actual
    reachable resources, not assume all-flows reach. A principal with appflow:* on Resource:* in an AWS
    account effectively controls all AppFlow flows and connector profiles in that account and region scope;
    this edge should be ACTIVE in that case.
  narrative: '{principal.name} has full control of all AppFlow resources in scope (appflow:*) and can
    redirect flows, create new exfil flows, read and modify connector profiles, and trigger data transfers.'