aws-asg-force-launch-trigger

id: aws-asg-force-launch-trigger
emits: CanTrigger
description: Force an ASG to launch fresh instances so attacker-modified config/identity takes effect.
where:
- ?principal has autoscaling:StartInstanceRefresh OR autoscaling:SetDesiredCapacity OR (ec2:TerminateInstances
  on ASG members, causing replacement)
- "OR an existing scaling policy (CloudWatch alarm) / scheduled action / health-check-driven replacement\
  \ will launch instances (service-driven via the service-linked role, no caller trigger needed) \u2014\
  \ this is the SLR PassRole-bypass case vs the caller-initiated case above"
- an ASG exists with capacity > 0 or can be scaled up
emit:
  target_type: Compute
  source: <principal>
  target: <newly launched EC2 instances of the ASG>
  permissions:
  - autoscaling:StartInstanceRefresh
  - autoscaling:SetDesiredCapacity
  - ec2:TerminateInstances
  conditions:
  - service_state
  note: Upgrades aws-asg-update-attach-identity / aws-asg-modify-userdata-exec / aws-asg-launch-template-passrole-bypass
    from CONDITIONAL to ACTIVE.
  false_positive_note: StartInstanceRefresh/SetDesiredCapacity re-run a RunInstances dry-run against the
    CALLER for CreateAutoScalingGroup/UpdateAutoScalingGroup/StartInstanceRefresh; but ongoing health-check/scaling-driven
    launches use the service-linked role. Distinguish caller-initiated (PassRole checked) from service-initiated
    (bypass).
  narrative: '{principal.name} can force ASG {target.name} to launch fresh instances (StartInstanceRefresh
    / SetDesiredCapacity / terminate-and-replace), applying the attacker-controlled launch config.'