aws-eb-scheduler-create-canschedule

scheduler:CreateSchedule lets a principal create a persistent cron/rate/one-time schedule that fires and invokes a target as the chosen execution role - a schedule-based persistence primitive.

derived aws emits CanSchedule

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Scheduler`
source	`?principal`
target	`?schedule_group`
permissions	`scheduler:CreateSchedule`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when scheduler:CreateSchedule is effective on the schedule group scope and not denied by SCP or permission boundary. BLOCKED when the action is denied. The full persistence path (CanExecuteAs) requires ALSO iam:PassRole for scheduler.amazonaws.com — that gate is in messaging-chains rule 3 (role_compatibility condition); emit this CanSchedule regardless, as it is the half-step fact.

source type

Identity

target type

Scheduler

source

?principal

target

?schedule_group

permissions

scheduler:CreateSchedule

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when scheduler:CreateSchedule is effective on the schedule group scope and not denied by SCP or permission boundary. BLOCKED when the action is denied. The full persistence path (CanExecuteAs) requires ALSO iam:PassRole for scheduler.amazonaws.com — that gate is in messaging-chains rule 3 (role_compatibility condition); emit this CanSchedule regardless, as it is the half-step fact.

Narrative

{principal.name} can create Scheduler schedules (scheduler:CreateSchedule) and, with iam:PassRole for scheduler.amazonaws.com, bind a chosen execution role; the schedule fires on its cadence executing as that role - persistent code execution requiring no further attacker interaction.

Raw rule rules/derived/aws/eventbridge.yaml

id: aws-eb-scheduler-create-canschedule
emits: CanSchedule
description: "scheduler:CreateSchedule lets a principal create a persistent cron/rate/one-time schedule\
  \ that fires and invokes a target as the chosen execution role \u2014 a schedule-based persistence primitive."
match:
- - principal: null
  - HasPermission
  - schedule_group: null
where:
- node_type(?schedule_group) == Scheduler
- effective_action(?principal, ?schedule_group) includes 'scheduler:CreateSchedule'
emit:
  source_type: Identity
  target_type: Scheduler
  source: ?principal
  target: ?schedule_group
  permissions:
  - scheduler:CreateSchedule
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "ACTIVE when scheduler:CreateSchedule is effective on the schedule group scope and not\
    \ denied by SCP or permission boundary. BLOCKED when the action is denied. The full persistence path\
    \ (CanExecuteAs) requires ALSO iam:PassRole for scheduler.amazonaws.com \u2014 that gate is in messaging-chains\
    \ rule 3 (role_compatibility condition); emit this CanSchedule regardless, as it is the half-step\
    \ fact."
  confidence: 0.9
  derived_from:
  - 'effective IAM evaluation: scheduler:CreateSchedule on ?schedule_group'
  false_positive_note: "scheduler:UpdateSchedule (without CreateSchedule) can modify EXISTING schedules\
    \ but not create new ones \u2014 model that as CanModifyConfiguration(principal, existing_schedule)\
    \ rather than CanSchedule. CanSchedule here specifically represents the ability to CREATE a new schedule\
    \ (new persistence). Honor iam:PassedToService = scheduler.amazonaws.com in the PassRole evaluation;\
    \ a principal without that PassRole cannot assign an execution role and the full CanExecuteAs path\
    \ is CONDITIONAL(role_compatibility) until confirmed."
  narrative: "{principal.name} can create Scheduler schedules (scheduler:CreateSchedule) and, with iam:PassRole\
    \ for scheduler.amazonaws.com, bind a chosen execution role; the schedule fires on its cadence executing\
    \ as that role \u2014 persistent code execution requiring no further attacker interaction."