aws-sf-eventbridge-rule-triggers-state-machine

id: aws-sf-eventbridge-rule-triggers-state-machine
emits: CanTrigger
description: An EventBridge rule with a Step Functions state machine as its target can start an execution
  when the rule matches; the EventBridge source is the event source, the state machine is the consumer.
match_record:
  resource_type: AWS::Events::Rule
  field: Targets[].Arn
where:
- target ARN matches an AWS::StepFunctions::StateMachine ARN
- rule State == ENABLED
- target IAM role has effective states:StartExecution on the target state machine
emit:
  source_type: EventRule
  target_type: GenericCompute
  source: <EventBridge Rule (EventRule)>
  target: <Step Functions State Machine (Workflow, modeled as GenericCompute for CanTrigger)>
  permissions: []
  conditions:
  - service_state
  - trigger_exists
  state_logic: ACTIVE when the rule is ENABLED and the target IAM role has effective states:StartExecution
    on the state machine. CONDITIONAL(trigger_exists) when the rule is DISABLED or the target role lacks
    the permission. BLOCKED if the rule has been explicitly disabled/deleted or the target role has a
    deny.
  derived_from:
  - AWS::Events::Rule.Targets[].Arn -> stateMachine (events:ListRules + events:ListTargetsByRule)
  false_positive_note: "Only ACTIVE if the rule State is ENABLED. A rule with State = DISABLED does not\
    \ fire and is CONDITIONAL(trigger_exists). Also verify the EventBridge target IAM role has states:StartExecution\
    \ on the target state machine \u2014 an incorrectly configured target role makes the trigger non-functional.\
    \ Event pattern / schedule expression filtering is a real control: a rule that only fires on a specific\
    \ source.detail-type may not be triggerable by the attacker's publish path. NOTE: permissions field\
    \ is omitted (empty) because the required permission (states:StartExecution) is the TARGET ROLE's\
    \ permission, not the attacker's. The attacker's actions are events:PutRule + events:PutTargets (from\
    \ A5)."
  narrative: EventBridge rule {rule.name} is configured to start an execution of state machine {stateMachine.name}
    when its event pattern matches (or on its schedule); an attacker who can publish matching events to
    the event bus triggers the state machine.