rage.fail

aws-batch-submit-job-invoke

derived aws emits CanInvoke

match (effective permission)

{ "action": "batch:SubmitJob", "resource_type": "AWS::Batch::JobDefinition" }

where

principal also has batch:SubmitJob on the target job-queue

emit

source type	`Identity`
source	`<principal>`
target	`<job definition>`
permissions	`batch:SubmitJob`
conditions	`iam_permission`

Narrative

{principal.name} can submit job definition {def.name} to a queue (batch:SubmitJob), causing it to run.

Raw rule rules/derived/aws/batch.yaml

id: aws-batch-submit-job-invoke
emits: CanInvoke
match_effective_permission:
  action: batch:SubmitJob
  resource_type: AWS::Batch::JobDefinition
where:
- principal also has batch:SubmitJob on the target job-queue
emit:
  source_type: Identity
  source: <principal>
  target: <job definition>
  permissions:
  - batch:SubmitJob
  conditions:
  - iam_permission
  target_type_note: 'The Batch job definition (ContainerTask) is treated as an invokable Workflow-equivalent
    CanInvoke target: SubmitJob drives its execution, completing an ExecutesAs escalation. Downstream
    validators should accept ContainerTask/Workflow as a CanInvoke target for this service; if the schema
    target set is enforced strictly, model this instead as CanTrigger (Identity -> Compute).'
  narrative: '{principal.name} can submit job definition {def.name} to a queue (batch:SubmitJob), causing
    it to run.'