aws-ssm-change-request-execution-trigger

ssm:StartChangeRequestExecution triggers an Automation runbook with Change Manager approval gating.

derived aws emits CanTrigger

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`BuildWorker`
source	`?principal`
target	`?runner`
permissions	`ssm:StartChangeRequestExecution`
conditions	`iam_permission` `approval_gate`
state logic	CONDITIONAL(approval_gate) by default — ssm:StartChangeRequestExecution submits a change request that must be approved by a Change Manager approver before the runbook executes. The approval workflow is a gating condition that prevents immediate execution. ACTIVE only if approval is pre-authorized or if the principal themselves hold iam:approveChangeRequest. BLOCKED when an SCP denies ssm:StartChangeRequestExecution.

source type

Identity

target type

BuildWorker

source

?principal

target

?runner

permissions

ssm:StartChangeRequestExecution

conditions

iam_permission approval_gate

state logic

CONDITIONAL(approval_gate) by default — ssm:StartChangeRequestExecution submits a change request that must be approved by a Change Manager approver before the runbook executes. The approval workflow is a gating condition that prevents immediate execution. ACTIVE only if approval is pre-authorized or if the principal themselves hold iam:approveChangeRequest. BLOCKED when an SCP denies ssm:StartChangeRequestExecution.

Narrative

{principal.name} can submit a change request via ssm:StartChangeRequestExecution to trigger runner {runner.name} (executing {document.name} as {role.name}), but the request must be approved by a Change Manager approver before execution proceeds.

Raw rule rules/derived/aws/ssm.yaml

id: aws-ssm-change-request-execution-trigger
emits: CanTrigger
description: ssm:StartChangeRequestExecution triggers an Automation runbook with Change Manager approval
  gating.
match:
- - principal: null
  - HasPermission
  - document: null
- - runner: null
  - ExecutesAs
  - role: null
where:
- effective_action == 'ssm:StartChangeRequestExecution'
- node_type(?document) == AutomationService
- ?document.document_type == 'Automation'
- node_type(?runner) == BuildWorker
- ?runner.document_arn == ?document.arn
emit:
  source_type: Identity
  target_type: BuildWorker
  source: ?principal
  target: ?runner
  permissions:
  - ssm:StartChangeRequestExecution
  conditions:
  - iam_permission
  - approval_gate
  state_logic: "CONDITIONAL(approval_gate) by default \u2014 ssm:StartChangeRequestExecution submits a\
    \ change request that must be approved by a Change Manager approver before the runbook executes. The\
    \ approval workflow is a gating condition that prevents immediate execution. ACTIVE only if approval\
    \ is pre-authorized or if the principal themselves hold iam:approveChangeRequest. BLOCKED when an\
    \ SCP denies ssm:StartChangeRequestExecution."
  confidence: 0.85
  derived_from:
  - effective ssm:StartChangeRequestExecution on ?document
  - ?runner ExecutesAs ?role
  false_positive_note: StartChangeRequestExecution is distinct from StartAutomationExecution because it
    routes through Change Manager approval. By default, emit this as CONDITIONAL(approval_gate) because
    an approver must review and accept the change request before execution. If the principal also holds
    iam:approveChangeRequest on their own changes, upgrade to ACTIVE (self-approval). Honor Change Manager
    configuration (approval required yes/no, approver list). Do NOT conflate with the direct-trigger path
    (StartAutomationExecution, which is ACTIVE by default).
  narrative: '{principal.name} can submit a change request via ssm:StartChangeRequestExecution to trigger
    runner {runner.name} (executing {document.name} as {role.name}), but the request must be approved
    by a Change Manager approver before execution proceeds.'