aws-sf-can-invoke-start-sync-execution
states:StartSyncExecution allows a principal to directly start a synchronous execution of an Express state machine with an attacker-supplied input payload.
match (effective permission)
{
"action": "states:StartSyncExecution",
"resource_type": "AWS::StepFunctions::StateMachine"
}
where
state machine type is EXPRESS (filtered during permission evaluation)
emit
| source type | Identity |
|---|---|
| target type | Workflow |
| source | <principal> |
| target | <Step Functions State Machine (Express Workflow)> |
| permissions | states:StartSyncExecution |
| conditions | iam_permission |
| state logic | ACTIVE when the principal has effective states:StartSyncExecution on an Express state machine. StartSyncExecution starts an execution and waits for the result, returning it directly to the caller — the attacker fully controls the execution's initial input JSON. BLOCKED if an SCP or permission boundary denies states:StartSyncExecution. |
Narrative
{principal.name} can synchronously start an execution of Express state machine {stateMachine.name} (states:StartSyncExecution), supplying the input payload and receiving the result directly.
Raw rule rules/derived/aws/stepfunctions.yaml
id: aws-sf-can-invoke-start-sync-execution
emits: CanInvoke
description: states:StartSyncExecution allows a principal to directly start a synchronous execution of
an Express state machine with an attacker-supplied input payload.
match_effective_permission:
action: states:StartSyncExecution
resource_type: AWS::StepFunctions::StateMachine
where:
- state machine type is EXPRESS (filtered during permission evaluation)
emit:
source_type: Identity
target_type: Workflow
source: <principal>
target: <Step Functions State Machine (Express Workflow)>
permissions:
- states:StartSyncExecution
conditions:
- iam_permission
state_logic: "ACTIVE when the principal has effective states:StartSyncExecution on an Express state\
\ machine. StartSyncExecution starts an execution and waits for the result, returning it directly\
\ to the caller \u2014 the attacker fully controls the execution's initial input JSON. BLOCKED if\
\ an SCP or permission boundary denies states:StartSyncExecution."
derived_from:
- effective states:StartSyncExecution on Express stateMachine scope
false_positive_note: "StartSyncExecution is Express-only; it is not valid for Standard workflows. Treat\
\ as CanInvoke with synchronous completion. The permission states:StartSyncExecution is distinct from\
\ states:StartExecution in IAM policies \u2014 a principal with only states:StartExecution cannot\
\ call StartSyncExecution and vice versa."
narrative: '{principal.name} can synchronously start an execution of Express state machine {stateMachine.name}
(states:StartSyncExecution), supplying the input payload and receiving the result directly.'