rage.fail

aws-apprunner-create-workload-as

Create a new App Runner service bound to a passed instance role -> execute as it.

derived aws emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanDeploy {'platform': None} {'principal': None} CanPassIdentity {'role': None}

where

?principal has effective apprunner:CreateService ?role trust allows tasks.apprunner.amazonaws.com

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<instance role>`
permissions	`apprunner:CreateService` `iam:PassRole`
state logic	ACTIVE if apprunner:CreateService + iam:PassRole(?role) satisfied; else CONDITIONAL(iam_permission)

Narrative

{principal.name} can create an App Runner service running attacker code with {role.name} as its instance role (apprunner:CreateService + iam:PassRole), executing as {role.name}.

Raw rule rules/derived/aws/apprunner.yaml

id: aws-apprunner-create-workload-as
emits: CanCreateWorkloadAs
description: Create a new App Runner service bound to a passed instance role -> execute as it.
match:
- - principal: null
  - CanDeploy
  - platform: null
- - principal: null
  - CanPassIdentity
  - role: null
where:
- ?principal has effective apprunner:CreateService
- ?role trust allows tasks.apprunner.amazonaws.com
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <instance role>
  state_logic: ACTIVE if apprunner:CreateService + iam:PassRole(?role) satisfied; else CONDITIONAL(iam_permission)
  permissions:
  - apprunner:CreateService
  - iam:PassRole
  derived_from:
  - <CanDeploy edge_id>
  - <CanPassIdentity edge_id>
  false_positive_note: Requires PassedToService to include tasks.apprunner.amazonaws.com and the role
    trust to allow it; otherwise CreateService rejects the role.
  narrative: '{principal.name} can create an App Runner service running attacker code with {role.name}
    as its instance role (apprunner:CreateService + iam:PassRole), executing as {role.name}.

    '