aws-apprunner-config-retarget-executeas

Retarget InstanceRoleArn to a more-privileged role via UpdateService + PassRole.

derived aws emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<chosen more-privileged instance role>`
permissions	`apprunner:UpdateService` `iam:PassRole`
state logic	ACTIVE if apprunner:UpdateService + iam:PassRole(?role) both satisfied; else CONDITIONAL(iam_permission)

source type

Identity

target type

Identity

source

<principal>

target

<chosen more-privileged instance role>

permissions

apprunner:UpdateService iam:PassRole

state logic

ACTIVE if apprunner:UpdateService + iam:PassRole(?role) both satisfied; else CONDITIONAL(iam_permission)

Narrative

{principal.name} can execute as {role.name} by setting it as {service.name}'s instance role (apprunner:UpdateService + iam:PassRole) and redeploying.

Raw rule rules/derived/aws/apprunner.yaml

id: aws-apprunner-config-retarget-executeas
emits: CanExecuteAs
description: Retarget InstanceRoleArn to a more-privileged role via UpdateService + PassRole.
match:
- - principal: null
  - CanAttachIdentity
  - service: null
- - principal: null
  - CanModifyConfiguration
  - service: null
- - principal: null
  - CanPassIdentity
  - role: null
where:
- node_type(?service) == ApplicationPlatform
- ?role trust allows tasks.apprunner.amazonaws.com
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <chosen more-privileged instance role>
  state_logic: ACTIVE if apprunner:UpdateService + iam:PassRole(?role) both satisfied; else CONDITIONAL(iam_permission)
  permissions:
  - apprunner:UpdateService
  - iam:PassRole
  conditions_from:
  - service: null
  - role: null
  derived_from:
  - <CanAttachIdentity edge_id>
  - <CanModifyConfiguration edge_id>
  - <CanPassIdentity edge_id>
  false_positive_note: iam:PassRole PassedToService must include tasks.apprunner.amazonaws.com; otherwise
    the role cannot be set as the instance role. Consumes the CanAttachIdentity edge (aws-apprunner-attach-identity)
    as the intermediate that binds ?role onto ?service, so that edge is no longer dead in the graph.
  narrative: '{principal.name} can execute as {role.name} by setting it as {service.name}''s instance
    role (apprunner:UpdateService + iam:PassRole) and redeploying.

    '