aws-sf-can-read-activity-task

id: aws-sf-can-read-activity-task
emits: CanReadData
description: "states:GetActivityTask returns the next queued task input from a Step Functions activity,\
  \ exposing the execution data context to the poller \u2014 any IAM principal with this permission can\
  \ dequeue tasks from the activity."
match_effective_permission:
  action: states:GetActivityTask
  resource_type: AWS::StepFunctions::Activity
emit:
  source_type: Identity
  target_type: GenericMessaging
  source: <principal>
  target: <Step Functions Activity (GenericMessaging)>
  permissions:
  - states:GetActivityTask
  conditions:
  - iam_permission
  state_logic: "ACTIVE when the principal has effective states:GetActivityTask on the activity ARN. The\
    \ API is unauthenticated to any specific execution \u2014 any caller with the permission can receive\
    \ the next available task input, depriving the legitimate worker of the task and exposing the payload.\
    \ CONDITIONAL(service_state) when the activity has no pending tasks (no running execution is currently\
    \ at an Activity task state that references this activity ARN). BLOCKED by SCP/permission boundary\
    \ deny."
  derived_from:
  - effective states:GetActivityTask on activity scope
  false_positive_note: "GetActivityTask long-polls (up to 60 seconds) for a task and returns when a task\
    \ becomes available. The action is scoped to the activity ARN \u2014 an attacker must know (or discover)\
    \ the ARN. The payload is the state machine's current execution input at the activity task state,\
    \ not a fixed value \u2014 it varies per execution. The consequence (credential-chains) only fires\
    \ when the payload contains a secret (A7 ContainsSecret edge must be present). A principal that calls\
    \ GetActivityTask also receives the taskToken which can be used with SendTaskSuccess/Failure to steer\
    \ the execution."
  narrative: '{principal.name} can call states:GetActivityTask on activity {activity.name}, dequeuing
    the next pending task''s input payload (the execution''s current data context) and receiving a taskToken
    that can be used to steer the running execution via SendTaskSuccess/Failure.'