aws-eb-putevent-canwritedata

id: aws-eb-putevent-canwritedata
emits: CanWriteData
description: events:PutEvents on a custom event bus lets a principal inject events that can match rules
  and trigger compute consumers.
match:
- - principal: null
  - HasPermission
  - bus: null
where:
- node_type(?bus) == EventBus
- effective_action(?principal, ?bus) includes 'events:PutEvents'
emit:
  source_type: Identity
  target_type: Messaging
  source: ?principal
  target: ?bus
  permissions:
  - events:PutEvents
  conditions:
  - iam_permission
  - resource_policy
  state_logic: 'ACTIVE when events:PutEvents is granted by the caller''s IAM policy AND not denied by
    the bus resource policy, an SCP, or a permission boundary. For the DEFAULT bus, CONDITIONAL(condition_expression):
    an attacker can inject custom- source events but cannot spoof service-reserved sources (source starting
    with "aws."); rules pattern-matching only aws.* sources are unreachable for a human caller. BLOCKED
    by an SCP or deny statement that prevents events:PutEvents.'
  confidence: 0.95
  derived_from:
  - 'effective IAM evaluation: events:PutEvents on ?bus'
  false_positive_note: "For the DEFAULT bus, a caller with events:PutEvents can only inject events with\
    \ non-aws.* sources; rules that match only aws.* source events (e.g., source: aws.ec2) cannot be triggered\
    \ by an arbitrary IAM principal \u2014 downgrade those rule-target paths to BLOCKED or CONDITIONAL(condition_expression).\
    \ For a CUSTOM bus the restriction does not apply unless the bus policy conditions further constrain\
    \ the source field. Always check that the IAM policy grant is not offset by a resource-policy explicit\
    \ Deny or SCP."
  narrative: '{principal.name} can publish events to {bus.name} (events:PutEvents); a crafted event matching
    an enabled rule''s pattern triggers the rule''s targets with an attacker-influenced payload.'