aws-sf-can-schedule-via-eventbridge-rule
Creating or updating an EventBridge rule that targets a Step Functions state machine is persistence: it fires on a schedule/event pattern, starting executions without further attacker action.
match (effective permission)
{
"action": "events:PutRule",
"resource_type": "AWS::Events::Rule"
}
where
principal also has effective events:PutTargets to set the target to a Step Functions state machine ARN
principal also has effective iam:PassRole for the EventBridge target role (or the rule uses the existing bound role)
emit
| source type | Identity |
|---|---|
| target type | EventRule |
| source | <principal> |
| target | <EventBridge Rule (EventRule)> |
| permissions | events:PutRule events:PutTargets iam:PassRole |
| conditions | iam_permission role_compatibility |
| state logic | ACTIVE when the principal has effective events:PutRule AND events:PutTargets AND iam:PassRole for the EventBridge target role (which must have states:StartExecution). CONDITIONAL(role_compatibility) when the target role or PassRole is uncertain. The rule fires on its configured schedule or event pattern — a persistence primitive independent of further attacker action. |
Narrative
{principal.name} can create or update an EventBridge rule targeting state machine {stateMachine.name} (events:PutRule + events:PutTargets + iam:PassRole), establishing a scheduled or event-driven trigger that fires executions without further attacker action.
Raw rule rules/derived/aws/stepfunctions.yaml
id: aws-sf-can-schedule-via-eventbridge-rule
emits: CanSchedule
description: 'Creating or updating an EventBridge rule that targets a Step Functions state machine is
persistence: it fires on a schedule/event pattern, starting executions without further attacker action.'
match_effective_permission:
action: events:PutRule
resource_type: AWS::Events::Rule
where:
- principal also has effective events:PutTargets to set the target to a Step Functions state machine ARN
- principal also has effective iam:PassRole for the EventBridge target role (or the rule uses the existing
bound role)
emit:
source_type: Identity
target_type: EventRule
source: <principal>
target: <EventBridge Rule (EventRule)>
permissions:
- events:PutRule
- events:PutTargets
- iam:PassRole
conditions:
- iam_permission
- role_compatibility
state_logic: "ACTIVE when the principal has effective events:PutRule AND events:PutTargets AND iam:PassRole\
\ for the EventBridge target role (which must have states:StartExecution). CONDITIONAL(role_compatibility)\
\ when the target role or PassRole is uncertain. The rule fires on its configured schedule or event\
\ pattern \u2014 a persistence primitive independent of further attacker action."
derived_from:
- effective events:PutRule + events:PutTargets + iam:PassRole (EventBridge)
false_positive_note: "CanSchedule here targets the EventRule node, not the state machine directly. messaging-chains\
\ rule 3 (messaging-schedule-persists-executes-as) requires both CanSchedule(?schedule) AND CanPassIdentity(?identity)\
\ where ?identity is the execution role the rule invokes the state machine as. Honor the PassRole\
\ scope: the EventBridge target role's trust must allow events.amazonaws.com, and iam:PassedToService\
\ must include events.amazonaws.com. A rule that targets a state machine in another account requires\
\ a cross-account EventBridge bus target and appropriate cross-account IAM grants. This is the EventBridge\
\ rule (events:PutRule) path \u2014 EventBridge Scheduler uses a separate scheduler:CreateSchedule\
\ path covered by aws-sf-can-schedule-via-scheduler."
narrative: '{principal.name} can create or update an EventBridge rule targeting state machine {stateMachine.name}
(events:PutRule + events:PutTargets + iam:PassRole), establishing a scheduled or event-driven trigger
that fires executions without further attacker action.'