aws-sf-alias-redirect
states:UpdateStateMachineAlias / states:CreateStateMachineAlias allows redirecting an alias to a different definition version without triggering visible definition-update alerts.
match (effective permission)
{
"action": [
"states:UpdateStateMachineAlias",
"states:CreateStateMachineAlias"
],
"resource_type": "AWS::StepFunctions::StateMachine"
}
where
alias currently routes traffic to the state machine (confirmed by listing aliases + their target versions)
emit
| source type | Identity |
|---|---|
| target type | Workflow |
| source | <principal> |
| target | <Step Functions State Machine (Workflow)> |
| permissions | states:UpdateStateMachineAlias states:CreateStateMachineAlias |
| conditions | iam_permission |
| state logic | ACTIVE when the principal has effective states:UpdateStateMachineAlias (or CreateStateMachineAlias if creating a new alias) and an alias is actively routing traffic to the state machine. Redirecting the alias to a previously-modified definition version is a stealth variant of CanModifyCode: the new version is already present, and the alias switch is invisible to logs that only track UpdateStateMachine (which is not called). BLOCKED if an SCP denies the alias action. |
Narrative
{principal.name} can redirect an alias of state machine {state_machine.name} (states:UpdateStateMachineAlias) to point to a previously-modified definition version, silently changing the code executed by that alias without triggering UpdateStateMachine events.
Raw rule rules/derived/aws/stepfunctions.yaml
id: aws-sf-alias-redirect
emits: CanModifyConfiguration
description: states:UpdateStateMachineAlias / states:CreateStateMachineAlias allows redirecting an alias
to a different definition version without triggering visible definition-update alerts.
match_effective_permission:
action:
- states:UpdateStateMachineAlias
- states:CreateStateMachineAlias
resource_type: AWS::StepFunctions::StateMachine
where:
- alias currently routes traffic to the state machine (confirmed by listing aliases + their target versions)
emit:
source_type: Identity
target_type: Workflow
source: <principal>
target: <Step Functions State Machine (Workflow)>
permissions:
- states:UpdateStateMachineAlias
- states:CreateStateMachineAlias
conditions:
- iam_permission
state_logic: 'ACTIVE when the principal has effective states:UpdateStateMachineAlias (or CreateStateMachineAlias
if creating a new alias) and an alias is actively routing traffic to the state machine. Redirecting
the alias to a previously-modified definition version is a stealth variant of CanModifyCode: the new
version is already present, and the alias switch is invisible to logs that only track UpdateStateMachine
(which is not called). BLOCKED if an SCP denies the alias action.'
derived_from:
- effective states:UpdateStateMachineAlias or states:CreateStateMachineAlias on stateMachine scope
false_positive_note: This is CanModifyConfiguration (redirecting execution targets) rather than CanModifyCode
(changing the definition itself) because the attacker reuses a previously-injected version. It feeds
can-execute-as execute-as-via-config-identity-swap if combined with CanPassIdentity to select a new
execution role. The alias-redirect capability is weaker than UpdateStateMachine (which creates code
control directly) but valuable as a stealth persistence mechanism. Step Functions does not produce
CloudWatch events for UpdateStateMachineAlias, making it harder to detect.
narrative: '{principal.name} can redirect an alias of state machine {state_machine.name} (states:UpdateStateMachineAlias)
to point to a previously-modified definition version, silently changing the code executed by that
alias without triggering UpdateStateMachine events.'