aws-apprunner-create-service
CreateService deploys a new App Runner workload (attacker code/image).
match (effective permission)
{
"action": "apprunner:CreateService",
"resource_type": "AWS::AppRunner::Service"
}
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <App Runner platform (account/region)> |
| permissions | apprunner:CreateService iam:PassRole? |
| conditions | iam_permission |
Narrative
{principal.name} can create a new App Runner service running attacker-controlled code (apprunner:CreateService).
Raw rule rules/derived/aws/apprunner.yaml
id: aws-apprunner-create-service
emits: CanDeploy
description: CreateService deploys a new App Runner workload (attacker code/image).
match_effective_permission:
action: apprunner:CreateService
resource_type: AWS::AppRunner::Service
optional_permission: iam:PassRole
emit:
source_type: Identity
source: <principal>
target: <App Runner platform (account/region)>
permissions:
- apprunner:CreateService
- iam:PassRole?
conditions:
- iam_permission
note: Pairs with CanPassIdentity to bind a chosen instance role (see aws-apprunner-create-workload-as).
narrative: '{principal.name} can create a new App Runner service running attacker-controlled code (apprunner:CreateService).'