aws-sf-can-modify-code-update
states:UpdateStateMachine allows replacing the ASL definition with arbitrary Task states that call AWS services as the execution role - equivalent to a buildspec rewrite.
match (effective permission)
{
"action": "states:UpdateStateMachine",
"resource_type": "AWS::StepFunctions::StateMachine"
}
emit
| source type | Identity |
|---|---|
| target type | GenericCompute |
| source | <principal> |
| target | <Step Functions State Machine (Workflow, modeled as GenericCompute)> |
| permissions | states:UpdateStateMachine |
| conditions | iam_permission |
| state logic | ACTIVE when the principal has effective states:UpdateStateMachine on the state machine scope. The API unconditionally replaces the definition with any valid ASL JSON — Task states can call any AWS SDK action the execution role permits. BLOCKED if an SCP or permission boundary denies states:UpdateStateMachine. |
Narrative
{principal.name} can replace the definition of state machine {stateMachine.name} (states:UpdateStateMachine), injecting Task states that call arbitrary AWS services as the execution role.
Raw rule rules/derived/aws/stepfunctions.yaml
id: aws-sf-can-modify-code-update
emits: CanModifyCode
description: "states:UpdateStateMachine allows replacing the ASL definition with arbitrary Task states\
\ that call AWS services as the execution role \u2014 equivalent to a buildspec rewrite."
match_effective_permission:
action: states:UpdateStateMachine
resource_type: AWS::StepFunctions::StateMachine
emit:
source_type: Identity
target_type: GenericCompute
source: <principal>
target: <Step Functions State Machine (Workflow, modeled as GenericCompute)>
permissions:
- states:UpdateStateMachine
conditions:
- iam_permission
state_logic: "ACTIVE when the principal has effective states:UpdateStateMachine on the state machine\
\ scope. The API unconditionally replaces the definition with any valid ASL JSON \u2014 Task states\
\ can call any AWS SDK action the execution role permits. BLOCKED if an SCP or permission boundary\
\ denies states:UpdateStateMachine."
derived_from:
- effective states:UpdateStateMachine on stateMachine scope
false_positive_note: "UpdateStateMachine always replaces the full definition; there is no IAM control\
\ over which Task states can be added. Any principal with effective states:UpdateStateMachine can\
\ inject arbitrary AWS SDK calls (e.g., arn:aws:states:::aws-sdk:iam:createUser) as Task states. Do\
\ NOT emit CanTrigger instead \u2014 UpdateStateMachine is CanModifyCode because the definition replacement\
\ is unconditional. Scope strictly: a Resource block limiting to specific state machine ARNs restricts\
\ the target set. State machines are modeled as Workflow (Messaging subtype), but for CanModifyCode\
\ target constraint we use GenericCompute (the closest valid Compute fallback) to satisfy the schema."
narrative: '{principal.name} can replace the definition of state machine {stateMachine.name} (states:UpdateStateMachine),
injecting Task states that call arbitrary AWS services as the execution role.'