aws-amplify-pass-service-role
iam:PassRole scoped to amplify.amazonaws.com lets a principal attach a service role to an Amplify App.
match (effective permission)
{
"action": "iam:PassRole",
"resource_type": "AWS::IAM::Role"
}
where
role trust policy allows amplify.amazonaws.com
iam:PassedToService condition (if present) includes amplify.amazonaws.com
emit
| source type | Identity |
|---|---|
| target type | MachineIdentity |
| source | <principal> |
| target | <IAM role passable to amplify.amazonaws.com> |
| permissions | iam:PassRole |
| conditions | iam_permission role_compatibility condition_expression |
| state logic | ACTIVE if iam:PassRole is satisfied for the role AND the role trust includes amplify.amazonaws.com. CONDITIONAL(role_compatibility) if the role trust does not explicitly include amplify.amazonaws.com (Amplify will reject the role assignment). BLOCKED if iam:PassedToService is present and does not include amplify.amazonaws.com. |
Narrative
{principal.name} can pass {role.name} to the Amplify service (iam:PassRole; trust allows amplify.amazonaws.com), enabling it to be set as an app's service role.
Raw rule rules/derived/aws/amplify.yaml
id: aws-amplify-pass-service-role
emits: CanPassIdentity
description: iam:PassRole scoped to amplify.amazonaws.com lets a principal attach a service role to an
Amplify App.
match_effective_permission:
action: iam:PassRole
resource_type: AWS::IAM::Role
where:
- role trust policy allows amplify.amazonaws.com
- iam:PassedToService condition (if present) includes amplify.amazonaws.com
emit:
source_type: Identity
target_type: MachineIdentity
source: <principal>
target: <IAM role passable to amplify.amazonaws.com>
permissions:
- iam:PassRole
conditions:
- iam_permission
- role_compatibility
- condition_expression
state_logic: ACTIVE if iam:PassRole is satisfied for the role AND the role trust includes amplify.amazonaws.com.
CONDITIONAL(role_compatibility) if the role trust does not explicitly include amplify.amazonaws.com
(Amplify will reject the role assignment). BLOCKED if iam:PassedToService is present and does not
include amplify.amazonaws.com.
confidence: 0.95
derived_from:
- '<HasPermission edge: ?principal iam:PassRole on ?role>'
false_positive_note: 'Honor iam:PassedToService rigorously: a role passable only to ec2.amazonaws.com
or lambda.amazonaws.com yields NO Amplify execution. Also distinguish the build service role (trust:
amplify.amazonaws.com) from the SSR Compute role (trust: amplify-hosting-compute.amazonaws.com or
similar SSR principal). Only a role trusting amplify.amazonaws.com produces an ExecutesAs edge and
thus a CanExecuteAs path through the build. Both role types require iam:PassRole but their downstream
attack value differs.'
narrative: '{principal.name} can pass {role.name} to the Amplify service (iam:PassRole; trust allows
amplify.amazonaws.com), enabling it to be set as an app''s service role.'