rage.fail

aws-acm-can-write-import

explicit aws emits CanWrite

match (effective permission)

{ "action": [ "acm:ImportCertificate", "acm:UpdateCertificateOptions" ], "resource_type": "AWS::CertificateManager::Certificate" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<certificate node>`
permissions	`acm:ImportCertificate` `acm:UpdateCertificateOptions`

Narrative

{principal.name} can overwrite/modify certificate {cert.name} (acm:ImportCertificate / acm:UpdateCertificateOptions).

Raw rule rules/explicit/aws-acm.yaml

id: aws-acm-can-write-import
emits: CanWrite
applies_to:
- aws
match_effective_permission:
  action:
  - acm:ImportCertificate
  - acm:UpdateCertificateOptions
  resource_type: AWS::CertificateManager::Certificate
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <certificate node>
  permissions:
  - acm:ImportCertificate
  - acm:UpdateCertificateOptions
  note: "acm:ImportCertificate on an existing ARN overwrites the served cert+key material (attacker TLS\
    \ to consumers, requires them to pick it up; noisy). acm:UpdateCertificateOptions toggles Certificate\
    \ Transparency logging \u2014 a weaker config write with no key-exportability or privilege impact.\
    \ Neither is an AWS IAM privilege escalation (no CanEscalateTo) nor a credential READ."
  narrative: '{principal.name} can overwrite/modify certificate {cert.name} (acm:ImportCertificate / acm:UpdateCertificateOptions).'