rage.fail

aws-apprunner-attach-identity

Update/CreateService + PassRole can attach/replace the identity the service runs as.

derived aws emits CanAttachIdentity

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanPassIdentity {'role': None}

where

?principal has effective apprunner:UpdateService OR apprunner:CreateService on the service ARN scope ?role trust allows tasks.apprunner.amazonaws.com

emit

source type	`Identity`
target type	`Compute`
source	`<principal>`
target	`<AppRunner::Service (existing or new)>`
permissions	`apprunner:UpdateService \| apprunner:CreateService` `iam:PassRole`

Narrative

{principal.name} can set {role.name} as the instance role of {service.name} (apprunner:UpdateService/CreateService + iam:PassRole).

Raw rule rules/derived/aws/apprunner.yaml

id: aws-apprunner-attach-identity
emits: CanAttachIdentity
description: Update/CreateService + PassRole can attach/replace the identity the service runs as.
match:
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has effective apprunner:UpdateService OR apprunner:CreateService on the service ARN scope
- ?role trust allows tasks.apprunner.amazonaws.com
emit:
  source_type: Identity
  target_type: Compute
  source: <principal>
  target: <AppRunner::Service (existing or new)>
  permissions:
  - apprunner:UpdateService | apprunner:CreateService
  - iam:PassRole
  note: Consumed by aws-apprunner-config-retarget-executeas as the intermediate CanAttachIdentity + ExecutesAs-retarget
    => CanExecuteAs; not a dead edge.
  narrative: '{principal.name} can set {role.name} as the instance role of {service.name} (apprunner:UpdateService/CreateService
    + iam:PassRole).'