aws-ecr-push-triggers-eventbridge

id: aws-ecr-push-triggers-eventbridge
emits: CanTrigger
description: An image push to ECR emits EventBridge events (ecr:PutImage action emits ECR Image Action
  event) that can trigger downstream Compute workloads (Lambda, CodePipeline, deploy workers), enabling
  trigger-based code execution.
match:
- - principal: null
  - CanModifyCode
  - repository: null
- - repository: null
  - CanTrigger
  - compute_target: null
where:
- node_type(?repository) == ContainerRegistry
- node_type(?compute_target) in [ServerlessFunction, BuildWorker, ContainerTask]
- ?compute_target is ultimately invoked by an EventBridge rule listening for ecr:PutImage events
- ?repository has an EventBridge source configuration for ecr:PutImage
optional:
- - repository: null
  - ContainsResourceReference
  - event_source: null
emit:
  source_type: Identity
  target_type: Compute
  source: ?principal
  target: ?compute_target
  permissions:
  - ecr:PutImage
  conditions:
  - iam_permission
  - trigger_exists
  state_logic: Inherit state from the matched CanModifyCode. ACTIVE when the principal can push images
    and the event rule / compute target is confirmed to exist and be active. CONDITIONAL(trigger_exists)
    when the event rule or downstream target does not yet exist but the principal can push to trigger
    its creation (POTENTIAL upgrade if CanCreateWorkload on the target exists). CONDITIONAL(service_state)
    when the event rule or target is disabled.
  confidence: 0.85 * contributing_confidence(CanModifyCode)
  derived_from:
  - ?principal CanModifyCode ?repository (from aws-ecr-push-can-modify-code)
  - ?repository has EventBridge source for ecr:PutImage events
  false_positive_note: 'PutImage generates ECR Image Action events that EventBridge can route to rules.
    Only emit CanTrigger when a Compute target (Lambda, CodePipeline, etc.) is confirmed to exist and
    to be listening for ecr:PutImage events (EventBridge rule with source: ''aws.ecr'' and event detail-type
    ''ECR Image Action''). Do not emit CanTrigger to EventBridge rules themselves (Messaging class); only
    to the Compute targets they ultimately invoke. Do not assume trigger capability without an explicit
    event rule or Compute target node.'
  narrative: '{principal.name} can push images to {repository.name} (ecr:PutImage), which emits ECR Image
    Action events to EventBridge. An EventBridge rule listens for these events and triggers {compute_target.name},
    giving {principal.name} the capability to trigger downstream Compute execution (cicd-chains propagates
    this to CanExecuteAs or CanModifyCode on the triggered workloads).'