aws-datapipeline-set-status-trigger
datapipeline:SetStatus can force-resume stalled pipeline objects, effectively re-triggering activities - an alternative to ActivatePipeline.
match (effective permission)
{
"action": "datapipeline:SetStatus",
"resource_type": "AWS::DataPipeline::Pipeline"
}
emit
| source type | Identity |
|---|---|
| target type | Messaging |
| source | <principal> |
| target | <AWS::DataPipeline::Pipeline Workflow node> |
| permissions | datapipeline:SetStatus |
| conditions | iam_permission condition_expression service_state |
Narrative
{principal.name} can force-resume stalled pipeline objects in {pipeline.name} (datapipeline:SetStatus), triggering activity execution as an alternative to ActivatePipeline. This completes the code-injection execute-as chain when ActivatePipeline permission is absent but SetStatus is available.
Raw rule rules/derived/aws/datapipeline.yaml
id: aws-datapipeline-set-status-trigger
emits: CanTrigger
description: "datapipeline:SetStatus can force-resume stalled pipeline objects, effectively re-triggering\
\ activities \u2014 an alternative to ActivatePipeline."
match_effective_permission:
action: datapipeline:SetStatus
resource_type: AWS::DataPipeline::Pipeline
emit:
source_type: Identity
target_type: Messaging
source: <principal>
target: <AWS::DataPipeline::Pipeline Workflow node>
permissions:
- datapipeline:SetStatus
conditions:
- iam_permission
- condition_expression
- service_state
false_positive_note: datapipeline:SetStatus is commonly used to resume failed pipeline objects by forcing
status RUNNING. This constitutes a trigger primitive when the pipeline is in a stalled/incomplete
state. On an already-completed pipeline with no pending objects, SetStatus does not trigger a new
run. Honor datapipeline:Tag and datapipeline:PipelineCreator conditions.
narrative: '{principal.name} can force-resume stalled pipeline objects in {pipeline.name} (datapipeline:SetStatus),
triggering activity execution as an alternative to ActivatePipeline. This completes the code-injection
execute-as chain when ActivatePipeline permission is absent but SetStatus is available.'