aws-codedeploy-pipeline-stage-trigger

id: aws-codedeploy-pipeline-stage-trigger
emits: CanTrigger
description: A CodePipeline Deploy stage action invokes the CodeDeploy deployment group; emit CanTrigger
  from the pipeline's execution identity so cicd-chains propagates pipeline-level trigger capability.
match:
- - pipelineidentity: null
  - CanExecuteAs
  - deploygroup: null
where:
- node_type(?deploygroup) == AutomationService
- ?deploygroup.provider_type == AWS::CodeDeploy::DeploymentGroup
- CodePipeline pipeline contains a Deploy stage action targeting this deployment group
emit:
  source_type: Identity
  target_type: Compute
  source: ?pipelineidentity
  target: ?deploygroup
  permissions:
  - codedeploy:CreateDeployment
  conditions:
  - service_state
  - trigger_exists
  state_logic: ACTIVE when the CodePipeline stage is enabled and the pipeline has a source trigger (webhook/poll/event)
    that arms it unconditionally. CONDITIONAL(trigger_exists) when the pipeline must be started manually
    (no automatic trigger). CONDITIONAL (stage_reachable) when a manual approval gate precedes this Deploy
    stage in the pipeline. BLOCKED if the pipeline or this stage is disabled.
  confidence: 0.9
  derived_from:
  - ?pipelineidentity CanExecuteAs ?deploygroup
  false_positive_note: "Only emit when the CodePipeline action configuration names this specific deployment\
    \ group (ApplicationName + DeploymentGroupName match). A pipeline with a manual approval gate BEFORE\
    \ the Deploy stage is CONDITIONAL(stage_reachable), not ACTIVE \u2014 cicd-chains rule 3 then keeps\
    \ the propagated CanTrigger CONDITIONAL. The source of this edge must be the pipeline's IAM execution\
    \ identity, which is in the Identity class (allowed for CanTrigger.source). The deployment group is\
    \ the target Compute runner."
  narrative: The CodePipeline pipeline {pipeline.name} execution identity can trigger deployments to CodeDeploy
    group {deploygroup.name} via its Deploy stage action (codedeploy:CreateDeployment), exposing the deployment
    group's execution identity to anyone who can trigger the pipeline.