aws-ssm-association-scheduled-trigger

id: aws-ssm-association-scheduled-trigger
emits: CanTrigger
description: A State Manager association with a cron schedule triggers the bound document against targeted
  instances automatically.
match:
- - association: null
  - CanTrigger
  - instance: null
where:
- node_type(?association) == Scheduler
- ?association.origin_service == 'aws:ssm'
- '?association.schedule_expression != null  # has an active schedule'
- node_type(?instance) == VirtualMachine
emit:
  source_type: Scheduler
  target_type: VirtualMachine
  source: ?association
  target: ?instance
  permissions: []
  conditions:
  - service_state
  state_logic: ACTIVE when the association has a non-null ScheduleExpression and the instance is in scope
    (matches Targets tag/resource-group/instance-ID filter) and Online. CONDITIONAL(service_state) when
    the instance is targeted by the association filter but its SSM connectivity is uncertain (PingStatus
    not Online). This edge enables cicd-chains:cicd-pipeline-orchestrates-stages to propagate a principal's
    CanTrigger(?principal -> ?association) to CanTrigger(?principal -> ?instance), and then cicd-trigger-runner-executes-as
    to produce CanExecuteAs if the definition is attacker-influenced.
  confidence: 0.9
  derived_from:
  - ?association CanTrigger ?instance (explicit, from ssm:ListAssociations)
  false_positive_note: "Only emit when ScheduleExpression is present and non-empty. An association with\
    \ ApplyOnlyAtCronInterval=true and no schedule is a one-shot, not a recurring trigger; emit CanTrigger\
    \ CONDITIONAL(trigger_exists) instead of ACTIVE. The instance must be in scope of the Targets filter\
    \ (check tag values, resource group membership, or explicit instance IDs). Do not emit for every instance\
    \ in the account \u2014 only those matched by the Targets specification."
  narrative: The State Manager association {association.name} fires on schedule ({association.schedule_expression})
    and targets {instance.name}, automatically delivering its document to that instance.