aws-athena-principal-triggers-lambda

id: aws-athena-principal-triggers-lambda
emits: CanTrigger
description: A principal with athena:StartQueryExecution on a LAMBDA-catalog workgroup can trigger the
  registered Lambda connector function.
match:
- - principal: null
  - HasPermission
  - workgroup: null
- - workgroup: null
  - CanTrigger
  - lambda_function: null
where:
- node_type(?workgroup) == AnalyticsService
- ?workgroup.provider_type == 'AWS::Athena::WorkGroup'
- ?principal has EFFECTIVE athena:StartQueryExecution on ?workgroup ARN
- node_type(?lambda_function) == ServerlessFunction
emit:
  source_type: Identity
  target_type: Compute
  source: ?principal
  target: ?lambda_function
  permissions:
  - athena:StartQueryExecution
  conditions:
  - iam_permission
  - service_state
  - trigger_exists
  state_logic: ACTIVE when athena:StartQueryExecution is confirmed EFFECTIVE on ?workgroup ARN, the workgroup
    State is ENABLED, the LAMBDA data catalog exists (via the explicit ?workgroup CanTrigger ?lambda_function
    edge), and the Lambda function exists and is not throttled. CONDITIONAL(service_state) when the workgroup
    is DISABLED. CONDITIONAL(trigger_exists) when the explicit CanTrigger edge is CONDITIONAL (Lambda
    ARN invalid/deleted). CONDITIONAL(iam_permission) when athena:StartQueryExecution is unconfirmed.
    Inherit weakest from contributing HasPermission and CanTrigger edges; a BLOCKED contributor blocks
    this derivation.
  confidence: min(contributing_confidences) * 0.90
  derived_from:
  - ?principal HasPermission ?workgroup (athena:StartQueryExecution effective permission)
  - '?workgroup CanTrigger ?lambda_function (explicit normalization: aws-athena-workgroup-triggers-lambda)'
  - "can-execute-as:execute-as-via-code-modify (CanModifyCode on connector + ExecutesAs -> CanExecuteAs\
    \ \u2014 cited not re-derived)"
  - "cicd-chains:cicd-modify-buildspec-executes-as (modify-what-it-runs -> executes-as \u2014 cited not\
    \ re-derived)"
  false_positive_note: "This edge is CanTrigger only \u2014 CanExecuteAs over the Lambda execution role\
    \ requires additionally that the attacker CanModifyCode the Lambda connector function; can-execute-as\
    \ executes-as-via-code-modify and/or cicd-chains cicd-modify-buildspec-executes-as produce that roll-up.\
    \ If the attacker can ONLY trigger (no code modification), cicd-chains cicd-trigger-runner-executes-as\
    \ applies but is CONDITIONAL(attacker_influenced_definition). Confirm the workgroup-to-Lambda binding:\
    \ the explicit CanTrigger edge must be ACTIVE or CONDITIONAL(trigger_exists), not BLOCKED. A missing\
    \ or deleted Lambda function behind the data catalog's LambdaFunctionArn makes this CONDITIONAL(trigger_exists).\
    \ Do not emit CanExecuteAs here; let can-execute-as produce that roll-up."
  narrative: '{principal.name} can submit federated queries to Athena workgroup {workgroup.name} (athena:StartQueryExecution).
    The workgroup''s data catalog is configured to trigger {lambda_function.name}; Athena invokes that
    function for each federated query. This is CanTrigger({principal.name} -> {lambda_function.name}).
    If {principal.name} can also modify the Lambda connector code (Lambda rules), can-execute-as produces
    CanExecuteAs over {lambda_function.name}''s execution role.'