aws-asg-create-launch-configuration
Create a launch configuration that embeds a privileged instance profile, then point an ASG at it.
match (effective permission)
{
"action": "autoscaling:CreateLaunchConfiguration",
"resource_type": "AWS::AutoScaling::LaunchConfiguration"
}
where
caller holds in-scope iam:PassRole (PassedToService=ec2) for the instance-profile role named in the launch configuration
caller can create or update an ASG to use this launch configuration
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <instance-profile role named in launch configuration> |
| permissions | autoscaling:CreateLaunchConfiguration iam:PassRole |
| conditions | iam_permission condition_expression role_compatibility |
Narrative
{principal.name} can create a launch configuration embedding instance-profile role {target.name} for use by an Auto Scaling group (autoscaling:CreateLaunchConfiguration + iam:PassRole).
Raw rule rules/derived/aws/autoscaling.yaml
id: aws-asg-create-launch-configuration
emits: CanPassIdentity
description: Create a launch configuration that embeds a privileged instance profile, then point an ASG
at it.
match_effective_permission:
action: autoscaling:CreateLaunchConfiguration
resource_type: AWS::AutoScaling::LaunchConfiguration
where:
- caller holds in-scope iam:PassRole (PassedToService=ec2) for the instance-profile role named in the
launch configuration
- caller can create or update an ASG to use this launch configuration
emit:
source_type: Identity
source: <principal>
target: <instance-profile role named in launch configuration>
permissions:
- autoscaling:CreateLaunchConfiguration
- iam:PassRole
conditions:
- iam_permission
- condition_expression
- role_compatibility
false_positive_note: Launch configurations are legacy; the instance profile is validated against the
caller's iam:PassRole. A launch config with no IamInstanceProfile (or a low-priv one) is not escalation.
narrative: '{principal.name} can create a launch configuration embedding instance-profile role {target.name}
for use by an Auto Scaling group (autoscaling:CreateLaunchConfiguration + iam:PassRole).'