aws-asg-create-workload-as
Create an Auto Scaling group whose launch template/config runs instances as a chosen instance-profile role.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?principal has autoscaling:CreateAutoScalingGroup AND ec2:RunInstances
?role is the role of an instance profile the attacker can reference (existing template/config, or a brand-new one the attacker can create via ec2:CreateLaunchTemplate / autoscaling:CreateLaunchConfiguration)
no SCP/boundary denies autoscaling:CreateAutoScalingGroup, ec2:RunInstances, or iam:PassRole
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <instance-profile role> |
| permissions | autoscaling:CreateAutoScalingGroup ec2:RunInstances iam:PassRole |
| conditions | iam_permission role_compatibility |
Narrative
{principal.name} can create an Auto Scaling group that launches EC2 instances running as {role.name} (autoscaling:CreateAutoScalingGroup + ec2:RunInstances + iam:PassRole).
Raw rule rules/derived/aws/autoscaling.yaml
id: aws-asg-create-workload-as
emits: CanCreateWorkloadAs
description: Create an Auto Scaling group whose launch template/config runs instances as a chosen instance-profile
role.
match:
- - principal: null
- CanPassIdentity
- role: null
where:
- ?principal has autoscaling:CreateAutoScalingGroup AND ec2:RunInstances
- ?role is the role of an instance profile the attacker can reference (existing template/config, or a
brand-new one the attacker can create via ec2:CreateLaunchTemplate / autoscaling:CreateLaunchConfiguration)
- no SCP/boundary denies autoscaling:CreateAutoScalingGroup, ec2:RunInstances, or iam:PassRole
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <instance-profile role>
permissions:
- autoscaling:CreateAutoScalingGroup
- ec2:RunInstances
- iam:PassRole
conditions:
- iam_permission
- role_compatibility
escalation: Create a new ASG bound to a privileged instance profile; launched instances run as that
role.
false_positive_note: CreateAutoScalingGroup performs an ec2:RunInstances DRY-RUN that checks the caller's
iam:PassRole at call time, so this path requires the caller to genuinely hold in-scope PassRole. If
PassRole is absent here, prefer aws-asg-launch-template-passrole-bypass instead.
narrative: '{principal.name} can create an Auto Scaling group that launches EC2 instances running as
{role.name} (autoscaling:CreateAutoScalingGroup + ec2:RunInstances + iam:PassRole).'