aws-athena-workgroup-triggers-lambda

An Athena workgroup configured with a LAMBDA data catalog triggers the registered Lambda connector function.

explicit aws emits CanTrigger

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`AnalyticsService`
target type	`ServerlessFunction`
source	`?workgroup`
target	`?lambda_function`
conditions	`trigger_exists` `service_state`
state logic	ACTIVE when the workgroup's DataCatalog Type is LAMBDA and the LambdaFunctionArn is populated and the Lambda function node exists and is not deleted/invalid. CONDITIONAL(trigger_exists) when the Lambda ARN is unresolvable or the function is missing. CONDITIONAL(service_state) when the workgroup is DISABLED.

source type

AnalyticsService

target type

ServerlessFunction

source

?workgroup

target

?lambda_function

conditions

trigger_exists service_state

state logic

ACTIVE when the workgroup's DataCatalog Type is LAMBDA and the LambdaFunctionArn is populated and the Lambda function node exists and is not deleted/invalid. CONDITIONAL(trigger_exists) when the Lambda ARN is unresolvable or the function is missing. CONDITIONAL(service_state) when the workgroup is DISABLED.

Narrative

Athena workgroup {workgroup.name} is configured with a LAMBDA data catalog pointing to {lambda_function.name}. Federated queries against this workgroup trigger the Lambda function. A principal with athena:StartQueryExecution on the workgroup can cause the Lambda to execute (rule 3: aws-athena-federated-triggers-lambda).

Raw rule rules/explicit/aws-athena.yaml

id: aws-athena-workgroup-triggers-lambda
emits: CanTrigger
description: An Athena workgroup configured with a LAMBDA data catalog triggers the registered Lambda
  connector function.
match:
- - workgroup: null
where:
- node_type(?workgroup) == AnalyticsService
- ?workgroup.provider_type == 'AWS::Athena::WorkGroup'
- ?workgroup has a DataCatalog association with Type == 'LAMBDA'
- ?workgroup.DataCatalog.LambdaFunctionArn is defined and valid
- ?lambda_function = resolve_node_by_arn(?workgroup.DataCatalog.LambdaFunctionArn)
- node_type(?lambda_function) == ServerlessFunction
emit:
  source_type: AnalyticsService
  target_type: ServerlessFunction
  source: ?workgroup
  target: ?lambda_function
  permissions: []
  conditions:
  - trigger_exists
  - service_state
  state_logic: ACTIVE when the workgroup's DataCatalog Type is LAMBDA and the LambdaFunctionArn is populated
    and the Lambda function node exists and is not deleted/invalid. CONDITIONAL(trigger_exists) when the
    Lambda ARN is unresolvable or the function is missing. CONDITIONAL(service_state) when the workgroup
    is DISABLED.
  confidence: 0.95
  derived_from:
  - athena:GetDataCatalog (workgroup config; Type field)
  - athena:GetWorkGroup (workgroup state)
  false_positive_note: "This edge asserts only the workgroup\u2192Lambda binding from configuration. It\
    \ does NOT mean any principal can trigger it \u2014 that requires rule 3 (aws-athena-federated-triggers-lambda)\
    \ which adds the principal's athena:StartQueryExecution permission. Confirm the LambdaFunctionArn\
    \ is actually populated and resolvable; a missing or deleted Lambda makes this CONDITIONAL(trigger_exists)."
  narrative: 'Athena workgroup {workgroup.name} is configured with a LAMBDA data catalog pointing to {lambda_function.name}.
    Federated queries against this workgroup trigger the Lambda function. A principal with athena:StartQueryExecution
    on the workgroup can cause the Lambda to execute (rule 3: aws-athena-federated-triggers-lambda).'