aws-eb-scheduler-update-canmodifyconfig

id: aws-eb-scheduler-update-canmodifyconfig
emits: CanModifyConfiguration
description: "scheduler:UpdateSchedule lets a principal change an existing schedule's target ARN, execution\
  \ role, or schedule expression \u2014 re-routing or re-timing execution."
match:
- - principal: null
  - HasPermission
  - schedule: null
where:
- node_type(?schedule) == Scheduler
- effective_action(?principal, ?schedule) includes 'scheduler:UpdateSchedule'
emit:
  source_type: Identity
  target_type: Messaging
  source: ?principal
  target: ?schedule
  permissions:
  - scheduler:UpdateSchedule
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: 'ACTIVE when scheduler:UpdateSchedule is effective on the schedule ARN and not denied.
    BLOCKED by SCP or explicit deny. This enables the config-identity-swap CanExecuteAs path (can-execute-as:
    execute-as-via-config-identity-swap) when combined with CanPassIdentity for a new execution role,
    and the messaging-chains rule 3 path when combined with CanPassIdentity.'
  confidence: 0.85
  derived_from:
  - 'effective IAM evaluation: scheduler:UpdateSchedule on ?schedule'
  false_positive_note: "Changing the schedule's Target.RoleArn via UpdateSchedule requires iam:PassRole\
    \ for the new role scoped to scheduler.amazonaws.com \u2014 without that, the attacker can change\
    \ the target ARN (re-point to a different resource) but not the execution role. The CanExecuteAs consequence\
    \ requires BOTH UpdateSchedule AND PassRole; emit this CanModifyConfiguration as a half-step; the\
    \ derivation engine applies the execute-as-via-config-identity-swap rule only when CanPassIdentity\
    \ is also present."
  narrative: '{principal.name} can modify the configuration of Scheduler schedule {schedule.name} (scheduler:UpdateSchedule),
    including re-pointing the target or (with iam:PassRole) changing the execution role, redirecting or
    escalating its scheduled execution.'