rage.fail

aws-apprunner-retrieve-token

Code executing on the service can fetch the instance role's session token.

derived aws emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteAs {'role': None}

emit

source	`<principal>`
target	`<instance role>`

Narrative

{principal.name}, running as {role.name} on App Runner, can retrieve {role.name}'s credentials from the container credential endpoint.

Raw rule rules/derived/aws/apprunner.yaml

id: aws-apprunner-retrieve-token
emits: CanRetrieveToken
description: Code executing on the service can fetch the instance role's session token.
match:
- - principal: null
  - CanExecuteAs
  - role: null
emit:
  source: <principal>
  target: <instance role>
  state: ACTIVE
  derived_from:
  - <CanExecuteAs edge_id>
  narrative: '{principal.name}, running as {role.name} on App Runner, can retrieve {role.name}''s credentials
    from the container credential endpoint.'