aws-eb-pipes-update-canmodifyconfig

id: aws-eb-pipes-update-canmodifyconfig
emits: CanModifyConfiguration
description: "pipes:UpdatePipe lets a principal change an existing Pipe's target, enrichment, source filter,\
  \ or execution role \u2014 re-routing or re-escalating persistent data flow."
match:
- - principal: null
  - HasPermission
  - pipe: null
where:
- node_type(?pipe) == EventRule
- ?pipe.provider_type == 'AWS::Pipes::Pipe'
- effective_action(?principal, ?pipe) includes 'pipes:UpdatePipe'
emit:
  source_type: Identity
  target_type: Messaging
  source: ?principal
  target: ?pipe
  permissions:
  - pipes:UpdatePipe
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: 'ACTIVE when pipes:UpdatePipe is effective on the pipe ARN and not denied by SCP or permission
    boundary. BLOCKED by SCP or explicit deny. This enables the config-identity-swap CanExecuteAs path
    (can-execute-as: execute-as-via-config-identity-swap) when combined with CanPassIdentity for a new
    execution role.'
  confidence: 0.85
  derived_from:
  - 'effective IAM evaluation: pipes:UpdatePipe on ?pipe'
  false_positive_note: "Changing the Pipe's Target.RoleArn via UpdatePipe requires iam:PassRole for the\
    \ new role scoped to pipes.amazonaws.com \u2014 without that, the attacker can change the target ARN\
    \ (re-point to a different resource) but not the execution role. The CanExecuteAs consequence requires\
    \ BOTH UpdatePipe AND PassRole; emit this CanModifyConfiguration as a half-step; the derivation engine\
    \ applies the execute-as-via-config-identity-swap rule only when CanPassIdentity is also present."
  narrative: '{principal.name} can modify an existing EventBridge Pipe {pipe.name} (pipes:UpdatePipe),
    including changing its target resource or (with iam:PassRole) its execution role, redirecting or escalating
    the persistent data-flow execution.'