aws-apigw-integration-exposes-creds-role

An API Gateway integration's credentials field references an IAM role; reading the integration config reveals which role the API uses as its execution identity.

derived aws emits ExposesCredential

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`APIGateway`
target type	`Identity`
source	`?api`
target	`?role`
permissions	`apigateway:GET`
state logic	ACTIVE when the integration credentials field is non-empty and retrievable via apigateway:GET on the integration resource. The role ARN is exposed in cleartext in the API configuration.

source type

APIGateway

target type

Identity

source

?api

target

?role

permissions

apigateway:GET

state logic

ACTIVE when the integration credentials field is non-empty and retrievable via apigateway:GET on the integration resource. The role ARN is exposed in cleartext in the API configuration.

Narrative

{api.name} is configured to execute as {role.name} (integration.credentials field); any principal with apigateway:GET on the integration can discover this role ARN, enabling targeted privilege escalation attempts.

Raw rule rules/derived/aws/apigateway.yaml

id: aws-apigw-integration-exposes-creds-role
emits: ExposesCredential
description: An API Gateway integration's credentials field references an IAM role; reading the integration
  config reveals which role the API uses as its execution identity.
match:
- - api: null
  - ExecutesAs
  - role: null
where:
- node_type(?api) in [APIGateway, GenericMessaging]
- ?role is the integration credentials role (reached via aws-apigw-executesas-credentials-role)
emit:
  source_type: APIGateway
  target_type: Identity
  source: ?api
  target: ?role
  permissions:
  - apigateway:GET
  state_logic: ACTIVE when the integration credentials field is non-empty and retrievable via apigateway:GET
    on the integration resource. The role ARN is exposed in cleartext in the API configuration.
  derived_from:
  - ?api ExecutesAs ?role (integration credentials)
  false_positive_note: ExposesCredential here records that the API config points to the role, making it
    discoverable (reconnaissance value). The escalation path is CanExecuteAs, not ExposesCredential ->
    CredentialsFor; the role ARN alone is not a usable credential. This edge enables queries like "what
    execution identities are reachable by reading API Gateway config?" without requiring an invocation
    path.
  narrative: '{api.name} is configured to execute as {role.name} (integration.credentials field); any
    principal with apigateway:GET on the integration can discover this role ARN, enabling targeted privilege
    escalation attempts.'