aws-sf-can-invoke-start-execution

id: aws-sf-can-invoke-start-execution
emits: CanInvoke
description: states:StartExecution or states:StartSyncExecution allows a principal to directly start a
  state machine execution with an attacker-supplied input payload.
match_effective_permission:
  action: states:StartExecution
  resource_type: AWS::StepFunctions::StateMachine
emit:
  source_type: Identity
  target_type: Workflow
  source: <principal>
  target: <Step Functions State Machine (Workflow)>
  permissions:
  - states:StartExecution
  conditions:
  - iam_permission
  state_logic: "ACTIVE when the principal has effective states:StartExecution (or states:StartSyncExecution\
    \ for Express workflows) on the state machine. The API starts an execution immediately with the caller-supplied\
    \ input JSON \u2014 the attacker fully controls the execution's initial data context. BLOCKED if an\
    \ SCP or permission boundary denies states:StartExecution."
  derived_from:
  - effective states:StartExecution on stateMachine scope
  false_positive_note: StartExecution is CanInvoke (direct, synchronous trigger with the caller in control
    of the input), NOT merely CanTrigger from a binding. The attacker-supplied input propagates through
    every state's input/output transformations and can influence downstream Task state parameters (e.g.,
    DynamoDB key, Lambda function name in a dynamic ARN). For Express workflows, states:StartSyncExecution
    provides synchronous execution with the result returned directly.
  narrative: '{principal.name} can start an execution of state machine {stateMachine.name} (states:StartExecution),
    supplying the input payload that drives the entire execution as {role.name}.'