aws-eb-startreplay-canwritedata

events:StartReplay re-delivers archived events to a target bus, triggering matching enabled rules - a CanWriteData equivalent that bypasses events:PutEvents.

derived aws emits CanWriteData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Messaging`
source	`?principal`
target	`?bus`
permissions	`events:StartReplay`
conditions	`iam_permission` `trigger_exists`
state logic	ACTIVE when events:StartReplay is effective on the archive ARN AND at least one enabled rule exists on the target bus whose event pattern matches the archived events (trigger_exists). CONDITIONAL(trigger_exists) when the archive exists but no matching enabled rules are present on the target bus. BLOCKED by SCP or explicit deny on events:StartReplay.

source type

Identity

target type

Messaging

source

?principal

target

?bus

permissions

events:StartReplay

conditions

iam_permission trigger_exists

state logic

ACTIVE when events:StartReplay is effective on the archive ARN AND at least one enabled rule exists on the target bus whose event pattern matches the archived events (trigger_exists). CONDITIONAL(trigger_exists) when the archive exists but no matching enabled rules are present on the target bus. BLOCKED by SCP or explicit deny on events:StartReplay.

Narrative

{principal.name} can replay archived events to {bus.name} (events:StartReplay), triggering any matching enabled rules on the bus - delivering attacker-influenced payloads to compute consumers without needing events:PutEvents.

Raw rule rules/derived/aws/eventbridge.yaml

id: aws-eb-startreplay-canwritedata
emits: CanWriteData
description: "events:StartReplay re-delivers archived events to a target bus, triggering matching enabled\
  \ rules \u2014 a CanWriteData equivalent that bypasses events:PutEvents."
match:
- - principal: null
  - HasPermission
  - archive: null
where:
- node_type(?archive) == GenericStorage
- ?archive.SourceArn references ?bus (the target bus for replay)
- effective_action(?principal, ?archive) includes 'events:StartReplay'
emit:
  source_type: Identity
  target_type: Messaging
  source: ?principal
  target: ?bus
  permissions:
  - events:StartReplay
  conditions:
  - iam_permission
  - trigger_exists
  state_logic: ACTIVE when events:StartReplay is effective on the archive ARN AND at least one enabled
    rule exists on the target bus whose event pattern matches the archived events (trigger_exists). CONDITIONAL(trigger_exists)
    when the archive exists but no matching enabled rules are present on the target bus. BLOCKED by SCP
    or explicit deny on events:StartReplay.
  confidence: 0.85
  derived_from:
  - 'effective IAM evaluation: events:StartReplay on ?archive; archive SourceArn references ?bus'
  false_positive_note: "Replay only triggers rules whose event pattern matches the archived events. If\
    \ the archive contains events with source: \"aws.s3\" but all enabled rules require a different source,\
    \ the replay will not trigger anything \u2014 downgrade to CONDITIONAL(trigger_exists) with a note\
    \ on the event filter. Always check both that StartReplay is effective on the archive AND that the\
    \ target bus has enabled rules (service_state: ENABLED) that match the archive's event schema."
  narrative: "{principal.name} can replay archived events to {bus.name} (events:StartReplay), triggering\
    \ any matching enabled rules on the bus \u2014 delivering attacker-influenced payloads to compute\
    \ consumers without needing events:PutEvents."