rage.fail

aws-add-role-to-instance-profile

derived aws emits CanAttachIdentity

where

?principal has iam:AddRoleToInstanceProfile (+ iam:CreateInstanceProfile if none exists) ?principal has ec2:RunInstances OR ec2:AssociateIamInstanceProfile ?principal has iam:PassRole for ?role

emit

source type	`Identity`
target type	`Compute`
source	`<principal>`
target	`<EC2 instance / new>`
permissions	`iam:AddRoleToInstanceProfile` `ec2:AssociateIamInstanceProfile` `iam:PassRole`

Narrative

{principal.name} can attach role {role.name} to an EC2 instance profile and run/associate it, executing as {role.name}.

Raw rule rules/derived/aws/identity-escalation.yaml

id: aws-add-role-to-instance-profile
emits: CanAttachIdentity
where:
- ?principal has iam:AddRoleToInstanceProfile (+ iam:CreateInstanceProfile if none exists)
- ?principal has ec2:RunInstances OR ec2:AssociateIamInstanceProfile
- ?principal has iam:PassRole for ?role
emit:
  source_type: Identity
  target_type: Compute
  source: <principal>
  target: <EC2 instance / new>
  permissions:
  - iam:AddRoleToInstanceProfile
  - ec2:AssociateIamInstanceProfile
  - iam:PassRole
  note: Chains to CanExecuteAs(role) via the instance profile.
  narrative: '{principal.name} can attach role {role.name} to an EC2 instance profile and run/associate
    it, executing as {role.name}.'