rage.fail

aws-add-user-to-group

derived aws emits CanAddMember

match (effective permission)

{ "action": "iam:AddUserToGroup", "resource_type": "AWS::IAM::Group" }

emit

source type	`Identity`
source	`<principal>`
target	`<IAM group in scope>`
permissions	`iam:AddUserToGroup`

Narrative

{principal.name} can add users to group {group.name} (iam:AddUserToGroup), inheriting its permissions.

Raw rule rules/derived/aws/identity-escalation.yaml

id: aws-add-user-to-group
emits: CanAddMember
match_effective_permission:
  action: iam:AddUserToGroup
  resource_type: AWS::IAM::Group
emit:
  source_type: Identity
  source: <principal>
  target: <IAM group in scope>
  permissions:
  - iam:AddUserToGroup
  escalation: Add a controllable user to a privileged group.
  narrative: '{principal.name} can add users to group {group.name} (iam:AddUserToGroup), inheriting its
    permissions.'