aws-apigw-create-api-as

Create a new API Gateway API with an integration bound to a passable credentials role, then invoke it - yields execution as that role.

derived aws emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?role`
permissions	`iam:PassRole` `apigateway:POST` `execute-api:Invoke?`
conditions	`role_compatibility` `iam_permission`
state logic	ACTIVE when the principal can create an API (apigateway:POST on /restapis or /apis), set an integration credentials to ?role (iam:PassRole to apigateway.amazonaws.com), create a deployment and stage, and invoke the API (execute-api:Invoke on the new invoke ARN). POTENTIAL(role_compatibility) when the role trust or iam:PassedToService is unknown. Note: execute-api:Invoke on the NEWLY created API is typically allowed to the creating account by default unless an explicit-deny resource policy blocks it.

source type

Identity

target type

Identity

source

?principal

target

?role

permissions

iam:PassRole apigateway:POST execute-api:Invoke?

conditions

role_compatibility iam_permission

state logic

ACTIVE when the principal can create an API (apigateway:POST on /restapis or /apis), set an integration credentials to ?role (iam:PassRole to apigateway.amazonaws.com), create a deployment and stage, and invoke the API (execute-api:Invoke on the new invoke ARN). POTENTIAL(role_compatibility) when the role trust or iam:PassedToService is unknown. Note: execute-api:Invoke on the NEWLY created API is typically allowed to the creating account by default unless an explicit-deny resource policy blocks it.

Narrative

{principal.name} can create a new API Gateway API (apigateway:POST) with an integration bound to {role.name} (iam:PassRole to apigateway.amazonaws.com), then invoke it (execute-api:Invoke) to execute the integration as {role.name}.

Raw rule rules/derived/aws/apigateway.yaml

id: aws-apigw-create-api-as
emits: CanCreateWorkloadAs
description: "Create a new API Gateway API with an integration bound to a passable credentials role, then\
  \ invoke it \u2014 yields execution as that role."
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has EFFECTIVE apigateway:POST on /restapis or /apis (create new API/integration)
- ?role trust policy allows apigateway.amazonaws.com
- iam:PassRole for ?role permits iam:PassedToService including apigateway.amazonaws.com (or unconditioned)
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?role
  permissions:
  - iam:PassRole
  - apigateway:POST
  - execute-api:Invoke?
  conditions:
  - role_compatibility
  - iam_permission
  state_logic: 'ACTIVE when the principal can create an API (apigateway:POST on /restapis or /apis), set
    an integration credentials to ?role (iam:PassRole to apigateway.amazonaws.com), create a deployment
    and stage, and invoke the API (execute-api:Invoke on the new invoke ARN). POTENTIAL(role_compatibility)
    when the role trust or iam:PassedToService is unknown. Note: execute-api:Invoke on the NEWLY created
    API is typically allowed to the creating account by default unless an explicit-deny resource policy
    blocks it.'
  confidence: min(contributing_confidences) * 0.9
  derived_from:
  - ?principal CanPassIdentity ?role
  false_positive_note: "Honor iam:PassedToService: a role restricted to ec2/ecs yields POTENTIAL, not\
    \ ACTIVE. The role MUST trust apigateway.amazonaws.com (trust principal). Creating an API also requires\
    \ apigateway:POST, apigateway:PUT/POST on resources/methods/integrations, and apigateway:POST on deployments\
    \ \u2014 broad create; a restrictive SCP may limit this. CITE can-execute-as.yaml execute-as-via-new-workload\
    \ for the abstract pattern; this rule fills in the API-Gateway-specific create path."
  narrative: '{principal.name} can create a new API Gateway API (apigateway:POST) with an integration
    bound to {role.name} (iam:PassRole to apigateway.amazonaws.com), then invoke it (execute-api:Invoke)
    to execute the integration as {role.name}.'