aws-eb-connection-contains-credential

An EventBridge Connection with API_KEY, OAUTH_CLIENT_CREDENTIALS, or BASIC auth contains a stored credential used to authenticate API destination calls.

derived aws emits ContainsSecret

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Messaging`
target type	`Credential`
source	`?connection`
target	`<credential stored in ?connection>`
state logic	ACTIVE when the Connection exists and its AuthorizationType is credential-bearing (API_KEY, OAUTH_CLIENT_CREDENTIALS, or BASIC). Credentials may be short-lived (OAuth access tokens refresh automatically by Scheduler) — confidence reflects that the stored value is a long-lived client secret / API key, not a transient token.

source type

Messaging

target type

Credential

source

?connection

target

<credential stored in ?connection>

state logic

ACTIVE when the Connection exists and its AuthorizationType is credential-bearing (API_KEY, OAUTH_CLIENT_CREDENTIALS, or BASIC). Credentials may be short-lived (OAuth access tokens refresh automatically by Scheduler) — confidence reflects that the stored value is a long-lived client secret / API key, not a transient token.

Narrative

EventBridge Connection {connection.name} stores a {auth_type} credential used for API destination authentication; this credential can be retrieved (with events:RetrieveConnectionCredentials) and used to authenticate to the target API.

Raw rule rules/derived/aws/eventbridge.yaml

id: aws-eb-connection-contains-credential
emits: ContainsSecret
description: An EventBridge Connection with API_KEY, OAUTH_CLIENT_CREDENTIALS, or BASIC auth contains
  a stored credential used to authenticate API destination calls.
match:
- - connection: null
  - HasProperty
  - AuthorizationType
where:
- node_type(?connection) == ConnectionString
- ?connection.AuthorizationType in ['API_KEY', 'OAUTH_CLIENT_CREDENTIALS', 'BASIC']
emit:
  source_type: Messaging
  target_type: Credential
  source: ?connection
  target: <credential stored in ?connection>
  permissions: []
  conditions: []
  state_logic: "ACTIVE when the Connection exists and its AuthorizationType is credential-bearing (API_KEY,\
    \ OAUTH_CLIENT_CREDENTIALS, or BASIC). Credentials may be short-lived (OAuth access tokens refresh\
    \ automatically by Scheduler) \u2014 confidence reflects that the stored value is a long-lived client\
    \ secret / API key, not a transient token."
  confidence: 0.85
  derived_from:
  - "events:DescribeConnection \u2192 AuthorizationType"
  false_positive_note: "The EventBridge Connections API does NOT expose the raw credential value via DescribeConnection\
    \ \u2014 only RetrieveConnectionCredentials does. This edge models the STRUCTURAL FACT that a credential\
    \ exists in the Connection, feeding credential-chains; it does not represent read access (that is\
    \ CanReadSecret above). If the credential is an OAuth access token (short-lived), the CredentialsFor\
    \ chain may be time-gated \u2014 note this in the confidence annotation."
  narrative: EventBridge Connection {connection.name} stores a {auth_type} credential used for API destination
    authentication; this credential can be retrieved (with events:RetrieveConnectionCredentials) and used
    to authenticate to the target API.