aws-sf-activity-task-contains-secret
A Step Functions activity task state embeds the current execution data context as the task payload returned by GetActivityTask; if upstream states processed sensitive data, the payload may contain secrets.
match (record)
{
"field": "activityArn",
"resource_type": "AWS::StepFunctions::Activity"
}
where
the activity ARN is referenced as a Task state Resource in a state machine whose execution data context is analyst-flagged as containing secrets, OR the state machine's execution role has
CanReadSecret permissions on secrets/SSM parameters
emit
| source type | GenericMessaging |
|---|---|
| target type | Secret |
| source | <Step Functions Activity (GenericMessaging)> |
| target | <secret or credential material in the task payload> |
| conditions | service_state |
| state logic | CONDITIONAL(service_state): only emit when the state machine definition and execution history evidence confirms sensitive data flows through the activity task state's data context. ACTIVE when analyst or regex scan has confirmed secrets in the task payload. This is a CONDITIONAL/analyst-gated edge — not automatically derivable from IAM policy alone. |
Narrative
Activity {activity.name} returns a task payload to GetActivityTask callers that includes the state machine's current data context; if upstream states have processed sensitive data (DB credentials, API keys, session tokens), those are exposed in the payload to any IAM principal that calls states:GetActivityTask on this activity ARN.
Raw rule rules/derived/aws/stepfunctions.yaml
id: aws-sf-activity-task-contains-secret
emits: ContainsSecret
description: A Step Functions activity task state embeds the current execution data context as the task
payload returned by GetActivityTask; if upstream states processed sensitive data, the payload may contain
secrets.
match_record:
resource_type: AWS::StepFunctions::Activity
field: activityArn
where:
- the activity ARN is referenced as a Task state Resource in a state machine whose execution data context
is analyst-flagged as containing secrets, OR the state machine's execution role has CanReadSecret permissions
on secrets/SSM parameters
emit:
source_type: GenericMessaging
target_type: Secret
source: <Step Functions Activity (GenericMessaging)>
target: <secret or credential material in the task payload>
permissions: []
conditions:
- service_state
state_logic: "CONDITIONAL(service_state): only emit when the state machine definition and execution\
\ history evidence confirms sensitive data flows through the activity task state's data context. ACTIVE\
\ when analyst or regex scan has confirmed secrets in the task payload. This is a CONDITIONAL/analyst-gated\
\ edge \u2014 not automatically derivable from IAM policy alone."
derived_from:
- AWS::StepFunctions::Activity + state machine definition analysis
false_positive_note: "Only emit when there is positive evidence (execution history scan, definition\
\ analysis, or analyst flag) that the execution data context at the activity task state contains credential\
\ material. The activity task payload is the state machine's current data context at that step \u2014\
\ upstream Lambda outputs, parameter lookups, etc. may or may not contain secrets. Do not emit for\
\ every activity without evidence; this will produce noise. credential-chains read-secret-yields-identity\
\ handles the downstream consequence once ContainsSecret + CredentialsFor are both present."
narrative: Activity {activity.name} returns a task payload to GetActivityTask callers that includes
the state machine's current data context; if upstream states have processed sensitive data (DB credentials,
API keys, session tokens), those are exposed in the payload to any IAM principal that calls states:GetActivityTask
on this activity ARN.