aws-datapipeline-put-definition-code

id: aws-datapipeline-put-definition-code
emits: CanModifyCode
description: datapipeline:PutPipelineDefinition replaces the pipeline object graph including shell commands
  and scriptUri, giving the principal arbitrary code control over the pipeline's activities.
match_effective_permission:
  action: datapipeline:PutPipelineDefinition
  resource_type: AWS::DataPipeline::Pipeline
emit:
  source_type: Identity
  target_type: Messaging
  source: <principal>
  target: <AWS::DataPipeline::Pipeline Workflow node>
  permissions:
  - datapipeline:PutPipelineDefinition
  conditions:
  - iam_permission
  - condition_expression
  false_positive_note: "datapipeline:PutPipelineDefinition scopes to Resource: \"*\" (no ARN-level restriction).\
    \ Access is narrowed by tag-based conditions (datapipeline:Tag), pipeline-creator conditions (datapipeline:PipelineCreator),\
    \ or workerGroup conditions. Honor these: if the effective policy has a datapipeline:Tag condition\
    \ that blocks the target pipeline's tags, do not emit. PutPipelineDefinition alone does NOT run anything\
    \ \u2014 a run path (ActivatePipeline or an active schedule) is required; without one this edge feeds\
    \ a CONDITIONAL CanExecuteAs via can-execute-as (trigger_exists unmet)."
  narrative: '{principal.name} can replace the definition of pipeline {pipeline.name} (datapipeline:PutPipelineDefinition),
    including the shell commands and script URIs that pipeline activities execute on EC2/EMR resource
    nodes.'