aws-eb-rule-triggers-target

A firing EventBridge rule invokes its configured target (Lambda, Step Functions, ECS, SQS, another bus, etc.) with the event payload.

derived aws emits CanTrigger

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Messaging`
target type	`Compute`
source	`?rule`
target	`?compute`
conditions	`service_state` `resource_policy`
state logic	ACTIVE when the rule is ENABLED and the target is reachable (resource policy or invocation role permits the target API call — for Lambda, the function resource policy grants events.amazonaws.com lambda:InvokeFunction; for SQS/Step Functions/ ECS the rule invocation role is present and has the required action). CONDITIONAL (resource_policy) when the target's resource policy or invocation role permissions are unknown. CONDITIONAL(service_state) when the rule is DISABLED.

source type

Messaging

target type

Compute

source

?rule

target

?compute

conditions

service_state resource_policy

state logic

ACTIVE when the rule is ENABLED and the target is reachable (resource policy or invocation role permits the target API call — for Lambda, the function resource policy grants events.amazonaws.com lambda:InvokeFunction; for SQS/Step Functions/ ECS the rule invocation role is present and has the required action). CONDITIONAL (resource_policy) when the target's resource policy or invocation role permissions are unknown. CONDITIONAL(service_state) when the rule is DISABLED.

Narrative

When {rule.name} fires, it invokes {compute.name} (via the EventBridge service using the rule's invocation role or the target's resource policy), delivering the matching event payload as attacker-influenced input.

Raw rule rules/derived/aws/eventbridge.yaml

id: aws-eb-rule-triggers-target
emits: CanTrigger
description: A firing EventBridge rule invokes its configured target (Lambda, Step Functions, ECS, SQS,
  another bus, etc.) with the event payload.
match:
- - rule: null
  - HasPolicy
  - target_binding: null
where:
- node_type(?rule) == EventRule
- ?target_binding references a target ARN (?compute or ?downstream_bus)
- node_class(?compute) == Compute or node_type(?compute) in [EventBus, Queue, Topic, Workflow]
emit:
  source_type: Messaging
  target_type: Compute
  source: ?rule
  target: ?compute
  permissions: []
  conditions:
  - service_state
  - resource_policy
  state_logic: "ACTIVE when the rule is ENABLED and the target is reachable (resource policy or invocation\
    \ role permits the target API call \u2014 for Lambda, the function resource policy grants events.amazonaws.com\
    \ lambda:InvokeFunction; for SQS/Step Functions/ ECS the rule invocation role is present and has the\
    \ required action). CONDITIONAL (resource_policy) when the target's resource policy or invocation\
    \ role permissions are unknown. CONDITIONAL(service_state) when the rule is DISABLED."
  confidence: 0.95
  derived_from:
  - "events:ListTargetsByRule \u2192 Targets[*].Arn"
  - "events:DescribeRule \u2192 State"
  false_positive_note: "For Lambda targets: EventBridge invokes Lambda via the function's resource-based\
    \ policy (grantee: events.amazonaws.com), NOT via the rule's RoleArn \u2014 do NOT propagate the rule's\
    \ invocation role as the Lambda execution identity. Lambda's own execution role is the ExecutesAs\
    \ on the Lambda node. For targets requiring a RoleArn (SQS, Step Functions, ECS, Kinesis, Firehose),\
    \ the rule invocation role IS the caller identity \u2014 model ExecutesAs(rule, invocation_role) separately.\
    \ A rule with multiple targets emits one CanTrigger per target. A dead-letter queue or error destination\
    \ is NOT a primary trigger target; skip it for CanTrigger."
  narrative: When {rule.name} fires, it invokes {compute.name} (via the EventBridge service using the
    rule's invocation role or the target's resource policy), delivering the matching event payload as
    attacker-influenced input.