aws-sf-can-read-execution-history
states:GetExecutionHistory returns the full event history of a Standard workflow execution including state input/output, which may contain sensitive data from the execution's data context.
match (effective permission)
{
"action": "states:GetExecutionHistory",
"resource_type": "AWS::StepFunctions::Execution"
}
emit
| source type | Identity |
|---|---|
| target type | GenericData |
| source | <principal> |
| target | <Step Functions Execution history (GenericData)> |
| permissions | states:GetExecutionHistory |
| conditions | iam_permission |
| state logic | ACTIVE when the principal has effective states:GetExecutionHistory on the execution scope. The API returns all events including state I/O for Standard workflows. BLOCKED if the workflow type is Express (Express executions log to CloudWatch, not GetExecutionHistory — the principal needs cloudwatch:GetLogEvents instead). A deny on states:GetExecutionHistory blocks this edge. |
Narrative
{principal.name} can read the full event history of execution {execution.name} (states:GetExecutionHistory), including every state's input and output data - which may contain sensitive parameters, API responses, or credentials that flowed through the execution's data context.
Raw rule rules/derived/aws/stepfunctions.yaml
id: aws-sf-can-read-execution-history
emits: CanReadData
description: states:GetExecutionHistory returns the full event history of a Standard workflow execution
including state input/output, which may contain sensitive data from the execution's data context.
match_effective_permission:
action: states:GetExecutionHistory
resource_type: AWS::StepFunctions::Execution
emit:
source_type: Identity
target_type: GenericData
source: <principal>
target: <Step Functions Execution history (GenericData)>
permissions:
- states:GetExecutionHistory
conditions:
- iam_permission
state_logic: "ACTIVE when the principal has effective states:GetExecutionHistory on the execution scope.\
\ The API returns all events including state I/O for Standard workflows. BLOCKED if the workflow type\
\ is Express (Express executions log to CloudWatch, not GetExecutionHistory \u2014 the principal needs\
\ cloudwatch:GetLogEvents instead). A deny on states:GetExecutionHistory blocks this edge."
derived_from:
- effective states:GetExecutionHistory on execution scope
false_positive_note: "Express workflow executions do NOT support GetExecutionHistory; the execution\
\ history for Express workflows is available only through CloudWatch Logs. Emit this edge only for\
\ Standard workflow executions. The execution history record is modeled as GenericData (a data artifact),\
\ not GenericCompute (a running resource). The data-plane consequence (CanExfiltrate if the history\
\ contains secrets) is handled by credential-chains \u2014 this edge only asserts the read capability.\
\ Honor SCP/permission boundary denials on states:GetExecutionHistory."
narrative: "{principal.name} can read the full event history of execution {execution.name} (states:GetExecutionHistory),\
\ including every state's input and output data \u2014 which may contain sensitive parameters, API\
\ responses, or credentials that flowed through the execution's data context."