aws-eb-pipes-create-canschedule

pipes:CreatePipe + iam:PassRole lets a principal create an EventBridge Pipe with a chosen target and execution role - a persistent source-to-target data flow.

derived aws emits CanSchedule

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`EventRule`
source	`?principal`
target	`<EventRule/Pipe created in ?pipe_scope>`
permissions	`pipes:CreatePipe`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when pipes:CreatePipe is effective on the resource scope and not denied by SCP or permission boundary. CONDITIONAL(role_compatibility) when iam:PassRole for the chosen role is unknown or not scoped to pipes.amazonaws.com. The full CanExecuteAs (pipe execution as chosen role) requires ALSO CanPassIdentity; messaging-chains rule 3 derives it when both are present.

source type

Identity

target type

EventRule

source

?principal

target

<EventRule/Pipe created in ?pipe_scope>

permissions

pipes:CreatePipe

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when pipes:CreatePipe is effective on the resource scope and not denied by SCP or permission boundary. CONDITIONAL(role_compatibility) when iam:PassRole for the chosen role is unknown or not scoped to pipes.amazonaws.com. The full CanExecuteAs (pipe execution as chosen role) requires ALSO CanPassIdentity; messaging-chains rule 3 derives it when both are present.

Narrative

{principal.name} can create EventBridge Pipes (pipes:CreatePipe) and, with iam:PassRole for pipes.amazonaws.com, bind a chosen execution role; the pipe continuously polls its source and invokes the target as the chosen role - persistent data-driven execution.

Raw rule rules/derived/aws/eventbridge.yaml

id: aws-eb-pipes-create-canschedule
emits: CanSchedule
description: "pipes:CreatePipe + iam:PassRole lets a principal create an EventBridge Pipe with a chosen\
  \ target and execution role \u2014 a persistent source-to-target data flow."
match:
- - principal: null
  - HasPermission
  - pipe_scope: null
where:
- node_type(?pipe_scope) in [AdministrativeBoundary, '*']
- effective_action(?principal, ?pipe_scope) includes 'pipes:CreatePipe'
emit:
  source_type: Identity
  target_type: EventRule
  source: ?principal
  target: <EventRule/Pipe created in ?pipe_scope>
  permissions:
  - pipes:CreatePipe
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when pipes:CreatePipe is effective on the resource scope and not denied by SCP or
    permission boundary. CONDITIONAL(role_compatibility) when iam:PassRole for the chosen role is unknown
    or not scoped to pipes.amazonaws.com. The full CanExecuteAs (pipe execution as chosen role) requires
    ALSO CanPassIdentity; messaging-chains rule 3 derives it when both are present.
  confidence: 0.9
  derived_from:
  - 'effective IAM evaluation: pipes:CreatePipe on ?pipe_scope'
  false_positive_note: "pipes:UpdatePipe (without CreatePipe) can modify EXISTING pipes \u2014 model that\
    \ as CanModifyConfiguration separately. CanSchedule here specifically represents the ability to CREATE\
    \ a new pipe. The execution role assignment requires iam:PassRole scoped to pipes.amazonaws.com; PassRole\
    \ for ec2/ecs does NOT yield this path. Honor iam:PassedToService when evaluating the role-passing\
    \ capability."
  narrative: "{principal.name} can create EventBridge Pipes (pipes:CreatePipe) and, with iam:PassRole\
    \ for pipes.amazonaws.com, bind a chosen execution role; the pipe continuously polls its source and\
    \ invokes the target as the chosen role \u2014 persistent data-driven execution."