aws-asg-execute-as

Roll-up: create/update/point an ASG at an instance profile and get code running as its role.

derived aws emits CanExecuteAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<instance-profile role>`
permissions	`autoscaling:CreateAutoScalingGroup` `autoscaling:UpdateAutoScalingGroup` `iam:PassRole` `ec2:RunInstances`
conditions	`iam_permission` `role_compatibility` `trigger_exists`
state logic	ACTIVE if launch is triggerable now (scaling policy/scheduled action present, or CanTrigger matched) else CONDITIONAL(trigger_exists)

source type

Identity

target type

Identity

source

<principal>

target

<instance-profile role>

permissions

autoscaling:CreateAutoScalingGroup autoscaling:UpdateAutoScalingGroup iam:PassRole ec2:RunInstances

conditions

iam_permission role_compatibility trigger_exists

state logic

ACTIVE if launch is triggerable now (scaling policy/scheduled action present, or CanTrigger matched) else CONDITIONAL(trigger_exists)

Narrative

{principal.name} can run code as {role.name} by launching EC2 instances through an Auto Scaling group bound to its instance profile.

Raw rule rules/derived/aws/autoscaling.yaml

id: aws-asg-execute-as
emits: CanExecuteAs
description: 'Roll-up: create/update/point an ASG at an instance profile and get code running as its role.'
match:
- - principal: null
  - CanCreateWorkloadAs
  - role: null
optional:
- - principal: null
  - CanTrigger
  - asg: null
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <instance-profile role>
  permissions:
  - autoscaling:CreateAutoScalingGroup
  - autoscaling:UpdateAutoScalingGroup
  - iam:PassRole
  - ec2:RunInstances
  state_logic: ACTIVE if launch is triggerable now (scaling policy/scheduled action present, or CanTrigger
    matched) else CONDITIONAL(trigger_exists)
  conditions:
  - iam_permission
  - role_compatibility
  - trigger_exists
  escalation: Instances launched by the ASG run as the instance-profile role; the attacker inherits that
    role via IMDS (CanRetrieveToken).
  false_positive_note: Resolve the instance profile to its role and confirm the role has privilege > the
    caller before flagging as escalation. Honor iam:PassRole scope and any autoscaling:LaunchTemplateVersionSpecified
    guardrail.
  narrative: '{principal.name} can run code as {role.name} by launching EC2 instances through an Auto
    Scaling group bound to its instance profile.'