aws-eb-putrule-canschedule

id: aws-eb-putrule-canschedule
emits: CanSchedule
description: "events:PutRule + events:PutTargets on a bus lets a principal create/modify rules and set\
  \ invocation targets and roles \u2014 a rule-based persistence and trigger creation primitive."
match:
- - principal: null
  - HasPermission
  - bus: null
where:
- node_type(?bus) == EventBus
- effective_action(?principal, ?bus) includes 'events:PutRule'
- effective_action(?principal, ?bus) includes 'events:PutTargets'
emit:
  source_type: Identity
  target_type: EventRule
  source: ?principal
  target: <EventRule created on ?bus>
  permissions:
  - events:PutRule
  - events:PutTargets
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when both events:PutRule and events:PutTargets are granted on the bus scope and
    not denied by an SCP or permission boundary. BLOCKED when either action is denied. The CanSchedule
    edge represents the CAPABILITY to create rules; the resulting CanExecuteAs (via messaging-chains rule
    3 + CanPassIdentity) is CONDITIONAL(role_compatibility) unless iam:PassRole for events.amazonaws.com
    is also confirmed.
  confidence: 0.9
  derived_from:
  - 'effective IAM evaluation: events:PutRule + events:PutTargets on ?bus'
  false_positive_note: "events:PutRule alone (without events:PutTargets) lets an attacker create a rule\
    \ but not set targets \u2014 reduce to POTENTIAL(iam_permission) in that case. Similarly, events:PutTargets\
    \ without events:PutRule cannot create NEW rules (only modify existing targets) \u2014 emit with a\
    \ note that the capability is limited to modifying existing rules. Full CanSchedule (create + target)\
    \ requires both actions. Honor iam:ResourceTag conditions if the bus uses tag-based ABAC for rule\
    \ creation."
  narrative: '{principal.name} can create EventBridge rules on {bus.name} and set their targets (events:PutRule
    + events:PutTargets); combined with iam:PassRole, this is persistence: a rule fires on its schedule
    or event pattern and invokes the chosen target as the chosen invocation role.'