aws-amplify-create-app-as

amplify:CreateApp + iam:PassRole creates a new Amplify App bound to a chosen service role.

derived aws emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`MachineIdentity`
source	`<principal>`
target	`<IAM service role>`
permissions	`amplify:CreateApp` `iam:PassRole`
conditions	`iam_permission` `role_compatibility`
state logic	ACTIVE if amplify:CreateApp and iam:PassRole(?role) are both satisfied and the role trust allows amplify.amazonaws.com. CONDITIONAL(role_compatibility) if the role trust is unresolved. After CreateApp the attacker must also set a buildSpec (inline or via a controlled repo amplify.yml) and trigger a build (amplify:StartJob or enable auto-build + push) to run as the role.

source type

Identity

target type

MachineIdentity

source

<principal>

target

<IAM service role>

permissions

amplify:CreateApp iam:PassRole

conditions

iam_permission role_compatibility

state logic

ACTIVE if amplify:CreateApp and iam:PassRole(?role) are both satisfied and the role trust allows amplify.amazonaws.com. CONDITIONAL(role_compatibility) if the role trust is unresolved. After CreateApp the attacker must also set a buildSpec (inline or via a controlled repo amplify.yml) and trigger a build (amplify:StartJob or enable auto-build + push) to run as the role.

Narrative

{principal.name} can create a new Amplify App with {role.name} as its service role (amplify:CreateApp + iam:PassRole), then deploy a buildSpec that runs arbitrary code as {role.name}.

Raw rule rules/derived/aws/amplify.yaml

id: aws-amplify-create-app-as
emits: CanCreateWorkloadAs
description: amplify:CreateApp + iam:PassRole creates a new Amplify App bound to a chosen service role.
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has effective amplify:CreateApp
- ?role trust policy allows amplify.amazonaws.com
emit:
  source_type: Identity
  target_type: MachineIdentity
  source: <principal>
  target: <IAM service role>
  permissions:
  - amplify:CreateApp
  - iam:PassRole
  conditions:
  - iam_permission
  - role_compatibility
  state_logic: ACTIVE if amplify:CreateApp and iam:PassRole(?role) are both satisfied and the role trust
    allows amplify.amazonaws.com. CONDITIONAL(role_compatibility) if the role trust is unresolved. After
    CreateApp the attacker must also set a buildSpec (inline or via a controlled repo amplify.yml) and
    trigger a build (amplify:StartJob or enable auto-build + push) to run as the role.
  derived_from:
  - <CanPassIdentity edge_id>
  false_positive_note: "CreateApp alone does not yield execution \u2014 the new app needs a buildSpec\
    \ with attacker-controlled commands AND a build trigger. Emit as ACTIVE for the workload-creation\
    \ capability; the execution step requires the additional StartJob / auto-build trigger (a separate\
    \ CanTrigger that the attacker also controls). iam:PassRole PassedToService must include amplify.amazonaws.com."
  narrative: '{principal.name} can create a new Amplify App with {role.name} as its service role (amplify:CreateApp
    + iam:PassRole), then deploy a buildSpec that runs arbitrary code as {role.name}.'