aws-datapipeline-put-definition-config
datapipeline:PutPipelineDefinition rewrites the pipeline's role, resourceRole, schedule, and cluster configuration - changing execution identity or trigger requires iam:PassRole for the new role.
match (effective permission)
{
"action": "datapipeline:PutPipelineDefinition",
"resource_type": "AWS::DataPipeline::Pipeline"
}
emit
| source type | Identity |
|---|---|
| target type | Messaging |
| source | <principal> |
| target | <AWS::DataPipeline::Pipeline Workflow node> |
| permissions | datapipeline:PutPipelineDefinition |
| conditions | iam_permission condition_expression |
Narrative
{principal.name} can rewrite the configuration of pipeline {pipeline.name} (datapipeline:PutPipelineDefinition), including its execution roles, schedule, and cluster settings.
Raw rule rules/derived/aws/datapipeline.yaml
id: aws-datapipeline-put-definition-config
emits: CanModifyConfiguration
description: "datapipeline:PutPipelineDefinition rewrites the pipeline's role, resourceRole, schedule,\
\ and cluster configuration \u2014 changing execution identity or trigger requires iam:PassRole for\
\ the new role."
match_effective_permission:
action: datapipeline:PutPipelineDefinition
resource_type: AWS::DataPipeline::Pipeline
emit:
source_type: Identity
target_type: Messaging
source: <principal>
target: <AWS::DataPipeline::Pipeline Workflow node>
permissions:
- datapipeline:PutPipelineDefinition
conditions:
- iam_permission
- condition_expression
false_positive_note: 'Changing the `role` or `resourceRole` fields additionally requires iam:PassRole
for the new target role; without it, the API rejects the update. Dedupes with rule 3 (CanModifyCode)
on the same permission; both edges are emitted because they feed different linchpin derivations: CanModifyCode
feeds execute-as-via-code-modify; CanModifyConfiguration feeds execute-as-via-config-identity-swap
(when combined with CanPassIdentity).'
narrative: '{principal.name} can rewrite the configuration of pipeline {pipeline.name} (datapipeline:PutPipelineDefinition),
including its execution roles, schedule, and cluster settings.'