aws-datapipeline-activate-pipeline

id: aws-datapipeline-activate-pipeline
emits: CanTrigger
description: datapipeline:ActivatePipeline starts a pipeline run, completing the execution path when combined
  with CanModifyCode on the pipeline's definition.
match_effective_permission:
  action: datapipeline:ActivatePipeline
  resource_type: AWS::DataPipeline::Pipeline
emit:
  source_type: Identity
  target_type: Messaging
  source: <principal>
  target: <AWS::DataPipeline::Pipeline Workflow node>
  permissions:
  - datapipeline:ActivatePipeline
  conditions:
  - iam_permission
  - condition_expression
  - service_state
  false_positive_note: "ActivatePipeline on an already-running pipeline with no pending schedule interval\
    \ may not immediately trigger a new run (the pipeline might be waiting for its next scheduled window).\
    \ For pipelines with scheduleType= ondemand, ActivatePipeline always triggers an immediate run. For\
    \ cron/ timeseries pipelines, it starts the pipeline and runs at the next scheduled interval. An active\
    \ schedule (scheduleType=cron/timeseries) also constitutes a trigger_exists condition even without\
    \ explicit ActivatePipeline permission \u2014 the pipeline runs autonomously. Honor datapipeline:Tag\
    \ conditions."
  narrative: '{principal.name} can activate pipeline {pipeline.name} (datapipeline:ActivatePipeline),
    starting a run that executes its activities on the configured EC2 or EMR resource nodes.'