aws-eb-rule-executes-as

An EventBridge rule assumes its invocation RoleArn (via events.amazonaws.com) to call targets that require IAM authorization; code running as that rule effectively runs as the invocation role.

derived aws emits ExecutesAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Messaging`
target type	`Role`
source	`?rule_record`
target	`?role`
conditions	`trust_relationship`
state logic	ACTIVE when the role trust policy allows events.amazonaws.com to assume it and the role is not deleted/disabled. CONDITIONAL(trust_relationship) when the trust cannot be confirmed. BLOCKED when the role does not trust events.amazonaws.com or an SCP denies sts:AssumeRole for the service principal.

source type

Messaging

target type

Role

source

?rule_record

target

?role

conditions

trust_relationship

state logic

ACTIVE when the role trust policy allows events.amazonaws.com to assume it and the role is not deleted/disabled. CONDITIONAL(trust_relationship) when the trust cannot be confirmed. BLOCKED when the role does not trust events.amazonaws.com or an SCP denies sts:AssumeRole for the service principal.

Narrative

{rule.name} assumes the IAM invocation role {role.name} (via events.amazonaws.com) to call its targets; any principal that can trigger {rule.name} effectively executes API calls as {role.name}.

Raw rule rules/derived/aws/eventbridge.yaml

id: aws-eb-rule-executes-as
emits: ExecutesAs
description: An EventBridge rule assumes its invocation RoleArn (via events.amazonaws.com) to call targets
  that require IAM authorization; code running as that rule effectively runs as the invocation role.
match:
- - rule_record: null
  - HasProperty
  - RoleArn
where:
- node_type(?rule_record) == EventRule
- ?rule_record.RoleArn is set (non-empty)
- ?role is the IAM role at ?rule_record.RoleArn
emit:
  source_type: Messaging
  target_type: Role
  source: ?rule_record
  target: ?role
  permissions: []
  conditions:
  - trust_relationship
  state_logic: ACTIVE when the role trust policy allows events.amazonaws.com to assume it and the role
    is not deleted/disabled. CONDITIONAL(trust_relationship) when the trust cannot be confirmed. BLOCKED
    when the role does not trust events.amazonaws.com or an SCP denies sts:AssumeRole for the service
    principal.
  confidence: 0.95
  derived_from:
  - "events:DescribeRule \u2192 RoleArn"
  false_positive_note: "Only emit when the rule actually HAS a RoleArn (most rules targeting Lambda do\
    \ not include a RoleArn; Lambda is invoked via the function resource policy not this role). The invocation\
    \ role is assumed by the EventBridge SERVICE, not by the attacker directly \u2014 the escalation path\
    \ is CanTrigger(attacker, rule) + this ExecutesAs, which messaging-chains rule 2 collapses into CanExecuteAs.\
    \ Do not conflate this role with the execution roles of individual Lambda/ECS targets."
  narrative: '{rule.name} assumes the IAM invocation role {role.name} (via events.amazonaws.com) to call
    its targets; any principal that can trigger {rule.name} effectively executes API calls as {role.name}.'