aws-apprunner-create-service

CreateService deploys a new App Runner workload (attacker code/image).

derived aws emits CanDeploy

match (effective permission)

{ "action": "apprunner:CreateService", "resource_type": "AWS::AppRunner::Service" }

emit

source typeIdentity
source<principal>
target<App Runner platform (account/region)>
permissionsapprunner:CreateService iam:PassRole?
conditionsiam_permission

Narrative

{principal.name} can create a new App Runner service running attacker-controlled code (apprunner:CreateService).

Raw rule rules/derived/aws/apprunner.yaml

id: aws-apprunner-create-service
emits: CanDeploy
description: CreateService deploys a new App Runner workload (attacker code/image).
match_effective_permission:
  action: apprunner:CreateService
  resource_type: AWS::AppRunner::Service
optional_permission: iam:PassRole
emit:
  source_type: Identity
  source: <principal>
  target: <App Runner platform (account/region)>
  permissions:
  - apprunner:CreateService
  - iam:PassRole?
  conditions:
  - iam_permission
  note: Pairs with CanPassIdentity to bind a chosen instance role (see aws-apprunner-create-workload-as).
  narrative: '{principal.name} can create a new App Runner service running attacker-controlled code (apprunner:CreateService).'
move · open · esc close