CanSchedule

Create an EventBridge/Scheduler target that runs an ECS task as a passable role.

events:PutRule + events:PutTargets on a bus lets a principal create/modify rules and set invocation targets and roles - a rule-based persistence and trigger creation primitive.

scheduler:CreateSchedule lets a principal create a persistent cron/rate/one-time schedule that fires and invokes a target as the chosen execution role - a schedule-based persistence primitive.

pipes:CreatePipe + iam:PassRole lets a principal create an EventBridge Pipe with a chosen target and execution role - a persistent source-to-target data flow.

sns:Subscribe lets an attacker create a new subscription (EventRule binding) on the topic, routing future publishes to a chosen Lambda or SQS endpoint.

Creating or updating an EventBridge rule that targets a Step Functions state machine is persistence: it fires on a schedule/event pattern, starting executions without further attacker action.

Creating an EventBridge Scheduler schedule that targets a Step Functions state machine is persistence: it fires on a cadence with an optional execution role, running the state machine without further attacker action.

Create or modify a recurring job schedule that starts a runbook in an Automation Account.

Create or modify an ADF trigger (Schedule / Tumbling Window) to fire pipelines autonomously as the factory MI - persistent execution.

A Logic App with a Recurrence trigger fires autonomously on a cadence - creating/modifying it with workflows/write is schedule creation.

Synapse Artifact Publisher role allows creating schedule/event/tumbling-window triggers that repeatedly run pipelines - persistence mechanism for code execution as the workspace MI.

cloudscheduler.jobs.create lets a principal create a new cron job - the persistence and event-source creation primitive. This feeds messaging-chains rule 3 (messaging-schedule-persists-executes-as) when paired with CanPassIdentity.

cloudscheduler.jobs.run triggers an immediate execution of the current job definition, bypassing the cron schedule - the on-demand CanSchedule primitive for an existing Cloud Scheduler job.

eventarc.triggers.create lets an attacker bind any reachable event source to any destination consumer as an Eventarc trigger - the event-source-binding creation primitive (Phase-10 CanSchedule).

eventarc.triggers.create/update lets an attacker bind a new event source (Pub/Sub topic, Audit Log, GCS event) to the workflow - the event-source-binding creation primitive.

Principal can create or update job schedules that periodically trigger pipeline or training jobs on AML compute.

Principal holds aiplatform.schedules.create to create recurring schedule triggers (explicit permission normalization).