aws-apprunner-modifycode-executeas

Modify code/image of a service that already has an instance role -> run as that role.

derived aws emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<instance role>`
permissions	`apprunner:UpdateService` `apprunner:StartDeployment?`
state logic	ACTIVE (UpdateService triggers an automatic deployment); CONDITIONAL(service_state) only if the service is PAUSED and principal lacks apprunner:ResumeService

source type

Identity

target type

Identity

source

<principal>

target

<instance role>

permissions

apprunner:UpdateService apprunner:StartDeployment?

state logic

ACTIVE (UpdateService triggers an automatic deployment); CONDITIONAL(service_state) only if the service is PAUSED and principal lacks apprunner:ResumeService

Narrative

{principal.name} can execute as {role.name} by changing the code/image of {service.name} (apprunner:UpdateService), which runs as {role.name}; UpdateService auto-deploys the change.

Raw rule rules/derived/aws/apprunner.yaml

id: aws-apprunner-modifycode-executeas
emits: CanExecuteAs
description: Modify code/image of a service that already has an instance role -> run as that role.
match:
- - principal: null
  - CanModifyCode
  - service: null
- - service: null
  - ExecutesAs
  - role: null
where:
- node_type(?service) == ApplicationPlatform
optional:
- - principal: null
  - CanDeploy
  - service: null
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <instance role>
  state_logic: ACTIVE (UpdateService triggers an automatic deployment); CONDITIONAL(service_state) only
    if the service is PAUSED and principal lacks apprunner:ResumeService
  permissions:
  - apprunner:UpdateService
  - apprunner:StartDeployment?
  conditions_from:
  - service: null
  - role: null
  derived_from:
  - <CanModifyCode edge_id>
  - <ExecutesAs edge_id>
  false_positive_note: 'Requires an existing instance role (ExecutesAs must be present). No instance role
    -> no privilege gain, do not emit. If the service is PAUSED, gate on apprunner:ResumeService (service_state).

    '
  narrative: '{principal.name} can execute as {role.name} by changing the code/image of {service.name}
    (apprunner:UpdateService), which runs as {role.name}; UpdateService auto-deploys the change.

    '