aws-sf-send-task-success-steers-execution
states:SendTaskSuccess / states:SendTaskFailure with a valid taskToken allows steering an active execution through branching logic or injecting data into downstream Task states.
match (effective permission)
{
"action": [
"states:SendTaskSuccess",
"states:SendTaskFailure"
],
"resource_type": "AWS::StepFunctions::Activity"
}
where
an execution is currently at an Activity task state that references this activity ARN (service_state condition)
principal has a valid taskToken (obtained via states:GetActivityTask or disclosed externally)
emit
| source type | Identity |
|---|---|
| target type | Workflow |
| source | <principal> |
| target | <Step Functions State Machine (Workflow with active execution)> |
| permissions | states:SendTaskSuccess states:SendTaskFailure |
| conditions | iam_permission service_state |
| state logic | CONDITIONAL(service_state): only emit when an execution is actively waiting at an Activity task state for this activity. The principal can inject a crafted output (for SendTaskSuccess) or failure (for SendTaskFailure) to steer the execution through conditional branching, skip approval steps, or modify parameters for downstream Task states. BLOCKED if the activity or execution is terminated. |
Narrative
{principal.name} can inject a task result (states:SendTaskSuccess) or failure (states:SendTaskFailure) into an active execution of {state_machine.name} at {activity.name}, steering the execution through conditional branches or bypassing approval steps.
Raw rule rules/derived/aws/stepfunctions.yaml
id: aws-sf-send-task-success-steers-execution
emits: CanModifyConfiguration
description: states:SendTaskSuccess / states:SendTaskFailure with a valid taskToken allows steering an
active execution through branching logic or injecting data into downstream Task states.
match_effective_permission:
action:
- states:SendTaskSuccess
- states:SendTaskFailure
resource_type: AWS::StepFunctions::Activity
where:
- an execution is currently at an Activity task state that references this activity ARN (service_state
condition)
- principal has a valid taskToken (obtained via states:GetActivityTask or disclosed externally)
emit:
source_type: Identity
target_type: Workflow
source: <principal>
target: <Step Functions State Machine (Workflow with active execution)>
permissions:
- states:SendTaskSuccess
- states:SendTaskFailure
conditions:
- iam_permission
- service_state
state_logic: 'CONDITIONAL(service_state): only emit when an execution is actively waiting at an Activity
task state for this activity. The principal can inject a crafted output (for SendTaskSuccess) or failure
(for SendTaskFailure) to steer the execution through conditional branching, skip approval steps, or
modify parameters for downstream Task states. BLOCKED if the activity or execution is terminated.'
derived_from:
- effective states:SendTaskSuccess / states:SendTaskFailure on activity scope
false_positive_note: "Requires a valid taskToken to call SendTaskSuccess/Failure \u2014 the principal\
\ must either have called states:GetActivityTask (and hence obtained the token) or the token must\
\ have been disclosed through another channel. The impact depends on execution flow: a crafted output\
\ that matches a conditional branch can skip authentication/approval logic. This is CanModifyConfiguration\
\ (modifying execution flow/state) not CanModifyCode (modifying the definition). Combines with CanPassIdentity\
\ for execute-as-via-config-identity-swap if the injected output includes an identity selection."
narrative: '{principal.name} can inject a task result (states:SendTaskSuccess) or failure (states:SendTaskFailure)
into an active execution of {state_machine.name} at {activity.name}, steering the execution through
conditional branches or bypassing approval steps.'