rage.fail

aws-cc-repo-trigger

explicit aws emits CanTrigger

match (record)

{ "field": "triggers[].destinationArn", "resource_type": "AWS::CodeCommit::Repository" }

where

triggers is non-empty triggers[].events includes 'all' or 'updateReference' or 'createReference' destinationArn points to a Lambda function (arn:aws:lambda:...)

emit

source type	`ArtifactRepository`
target type	`Compute`
source	`<ArtifactRepository node>`
target	`<Lambda function (ServerlessFunction) at destinationArn>`

Narrative

{repo.name} is configured to trigger Lambda function {target.name} on push events (events: {trigger_events}; branches: {trigger_branches or 'all'}); any push to the repository fires this Lambda trigger, enabling the cicd-chains CanModifyCode + ExecutesAs => CanExecuteAs roll-up.

Raw rule rules/explicit/aws-codecommit.yaml

id: aws-cc-repo-trigger
emits: CanTrigger
applies_to:
- aws
note: Repository trigger to Lambda function (compute target). SNS topic triggers are structural inventory
  (ContainsResourceReference) because CanTrigger's target set is [Compute] and SNS Topic is Messaging,
  not Compute.
match_record:
  resource_type: AWS::CodeCommit::Repository
  field: triggers[].destinationArn
where:
- triggers is non-empty
- triggers[].events includes 'all' or 'updateReference' or 'createReference'
- destinationArn points to a Lambda function (arn:aws:lambda:...)
emit:
  source_type: ArtifactRepository
  target_type: Compute
  source: <ArtifactRepository node>
  target: <Lambda function (ServerlessFunction) at destinationArn>
  api_source: codecommit:GetRepositoryTriggers
  evidence_field: triggers[].destinationArn, triggers[].events, triggers[].branches
  properties:
    trigger_events: triggers[].events
    trigger_branches: triggers[].branches (empty = all branches)
  narrative: '{repo.name} is configured to trigger Lambda function {target.name} on push events (events:
    {trigger_events}; branches: {trigger_branches or ''all''}); any push to the repository fires this
    Lambda trigger, enabling the cicd-chains CanModifyCode + ExecutesAs => CanExecuteAs roll-up.'