rage.fail

aws-sqs-esm-binding

explicit aws emits CanTrigger

match (record)

{ "field": "EventSourceArn", "resource_type": "AWS::Lambda::EventSourceMapping" }

where

EventSourceArn contains ':sqs:'

emit

source type	`Queue`
target type	`ServerlessFunction`
source	`<SQS queue node matching EventSourceArn>`
target	`<Lambda function node matching FunctionArn>`
conditions	`trigger_exists` `service_state`
state logic	ACTIVE when State == Enabled. CONDITIONAL(trigger_exists) when State is Disabled, Creating, or Updating. BLOCKED when the function resource-based policy denies Lambda invocation.

Narrative

{queue.name} triggers {function.name} via a SQS event-source-mapping (State: {esm.State}).

Raw rule rules/explicit/aws-sqs.yaml

id: aws-sqs-esm-binding
emits: CanTrigger
applies_to:
- aws
match_record:
  resource_type: AWS::Lambda::EventSourceMapping
  field: EventSourceArn
where:
- EventSourceArn contains ':sqs:'
emit:
  source_type: Queue
  target_type: ServerlessFunction
  source: <SQS queue node matching EventSourceArn>
  target: <Lambda function node matching FunctionArn>
  api_source: lambda:ListEventSourceMappings
  evidence_field: EventSourceArn, FunctionArn, State
  conditions:
  - trigger_exists
  - service_state
  state_logic: ACTIVE when State == Enabled. CONDITIONAL(trigger_exists) when State is Disabled, Creating,
    or Updating. BLOCKED when the function resource-based policy denies Lambda invocation.
  narrative: '{queue.name} triggers {function.name} via a SQS event-source-mapping (State: {esm.State}).'