Scheduler

An EventBridge rule / EventBridge Scheduler target or a Step Functions state that calls batch:SubmitJob against a definition is an attacker-reachable execution trigger.

scheduler:CreateSchedule lets a principal create a persistent cron/rate/one-time schedule that fires and invokes a target as the chosen execution role - a schedule-based persistence primitive.

An EventBridge Scheduler schedule assumes its Target.RoleArn (via scheduler.amazonaws.com) at each fire; anyone who can modify the schedule or the role effectively runs as that role on a cadence.

scheduler:UpdateSchedule lets a principal change an existing schedule's target ARN, execution role, or schedule expression - re-routing or re-timing execution.

Creating an EventBridge Scheduler schedule that targets a Step Functions state machine is persistence: it fires on a cadence with an optional execution role, running the state machine without further attacker action.

A State Manager association with a cron schedule triggers the bound document against targeted instances automatically.

ssm:UpdateAssociation changes the document or command parameters of a State Manager association, injecting attacker code into the managed instances the association targets.

Start a stopped ADF trigger to realize CONDITIONAL(trigger_exists) execution edges.

Create or modify an ADF trigger (Schedule / Tumbling Window) to fire pipelines autonomously as the factory MI - persistent execution.

Principal can create or update job schedules that periodically trigger pipeline or training jobs on AML compute.

Create or modify a recurring job schedule that starts a runbook in an Automation Account.

A Cloud Scheduler App Engine HTTP job triggers an App Engine service on schedule. App Engine targets are always same-project. OIDC/OAuth2 auth model applies identically to HTTP targets.

Update the serviceAccountEmail field of an HTTP job's oidcToken/oauthToken to swap the execution identity (jobs.update + actAs on new SA).

cloudscheduler.jobs.create lets a principal create a new cron job - the persistence and event-source creation primitive. This feeds messaging-chains rule 3 (messaging-schedule-persists-executes-as) when paired with CanPassIdentity.

A principal with cloudscheduler.jobs.create can establish a Pub/Sub job that publishes attacker-controlled data to any topic in the project on schedule. No actAs required. Feeds messaging-chains rules 1+2 for CanTrigger -> CanExecuteAs chain.

A Cloud Scheduler Pub/Sub job targeting a topic in a different project establishes cross-project trust - the Cloud Scheduler service agent must hold roles/pubsub.publisher in the external project.

A Cloud Scheduler HTTP job whose configured SA holds role bindings in a different project establishes cross-project trust - an attacker who can create/update the job (with actAs on the SA) can invoke APIs in the other project as that SA.

A Cloud Scheduler HTTP job binds to a compute target (Cloud Run, Cloud Functions, App Engine, or other HTTP endpoint). The job fires on schedule sending the OIDC/OAuth2 bearer - this is the CanTrigger binding fact consumed by messaging-chains.

actAs on a SA that the principal names in an HTTP job's oidcToken.serviceAccountEmail or oauthToken.serviceAccountEmail is the GCP PassRole analog for Cloud Scheduler. Required to create or update a job with an authenticated HTTP target.

cloudscheduler.jobs.run triggers an immediate execution of the current job definition, bypassing the cron schedule - the on-demand CanSchedule primitive for an existing Cloud Scheduler job.

cloudscheduler.jobs.update lets a principal change an existing job's URI, headers, body, schedule, or OIDC/OAuth2 SA. This is the configuration-change primitive; URI-retarget (no new actAs needed) and SA-swap (actAs required) are the two attack patterns.

Retargeting an existing HTTP job's URI (via jobs.update) to an attacker-controlled endpoint causes the existing SA's OIDC/OAuth2 bearer token to be delivered on the next invocation - no actAs on the SA required since the SA is unchanged.

Creating a schedule/rule that invokes a target as a passed execution identity is persistence and yields execution as that identity.