aws-batch-trigger-scheduled-submit
An EventBridge rule / EventBridge Scheduler target or a Step Functions state that calls batch:SubmitJob against a definition is an attacker-reachable execution trigger.
match (record)
{
"field": "target/state -\u003e batch:SubmitJob",
"resource_type": "AWS::Events::Rule / AWS::Scheduler::Schedule / AWS::StepFunctions::StateMachine"
}
where
an EventBridge rule target, EventBridge
Scheduler target, or Step Functions state invokes batch:SubmitJob against the job definition
emit
| target type | Compute |
|---|---|
| source | <EventBridge rule / Scheduler schedule / Step Functions state machine> |
| target | <job definition (ContainerTask)> |
| conditions | trigger_exists |
Narrative
Batch job definition {def.name} can be executed by an existing EventBridge rule/Scheduler/Step Functions trigger that submits it (CanTrigger).
Raw rule rules/derived/aws/batch.yaml
id: aws-batch-trigger-scheduled-submit
emits: CanTrigger
description: An EventBridge rule / EventBridge Scheduler target or a Step Functions state that calls batch:SubmitJob
against a definition is an attacker-reachable execution trigger.
match_record:
resource_type: AWS::Events::Rule / AWS::Scheduler::Schedule / AWS::StepFunctions::StateMachine
field: target/state -> batch:SubmitJob
where:
- an EventBridge rule target, EventBridge Scheduler target, or Step Functions state invokes batch:SubmitJob
against the job definition
emit:
target_type: Compute
source: <EventBridge rule / Scheduler schedule / Step Functions state machine>
target: <job definition (ContainerTask)>
state: CONDITIONAL
conditions:
- trigger_exists
false_positive_note: Only emit when an existing schedule/rule/state machine actually targets batch:SubmitJob
for this definition; a trigger that must first be created is POTENTIAL, not CONDITIONAL. The submitted
job runs as the definition's jobRoleArn.
narrative: Batch job definition {def.name} can be executed by an existing EventBridge rule/Scheduler/Step
Functions trigger that submits it (CanTrigger).