aws-asg-pass-instance-profile
Caller can pass an instance-profile role to EC2 through an Auto Scaling launch template/config.
match (effective permission)
{
"action": "iam:PassRole",
"resource_type": "AWS::IAM::Role"
}
where
?role is (or can be) the role inside an instance profile referenced by a launch template/config
iam:PassedToService (if present) includes ec2.amazonaws.com
caller also holds autoscaling:CreateAutoScalingGroup OR autoscaling:UpdateAutoScalingGroup OR ec2:RunInstances
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <instance-profile role in scope> |
| permissions | iam:PassRole |
| conditions | iam_permission condition_expression role_compatibility |
Narrative
{principal.name} can pass instance-profile role {target.name} to EC2 via an Auto Scaling launch template/config (iam:PassRole, PassedToService=ec2).
Raw rule rules/derived/aws/autoscaling.yaml
id: aws-asg-pass-instance-profile
emits: CanPassIdentity
description: Caller can pass an instance-profile role to EC2 through an Auto Scaling launch template/config.
match_effective_permission:
action: iam:PassRole
resource_type: AWS::IAM::Role
where:
- ?role is (or can be) the role inside an instance profile referenced by a launch template/config
- iam:PassedToService (if present) includes ec2.amazonaws.com
- caller also holds autoscaling:CreateAutoScalingGroup OR autoscaling:UpdateAutoScalingGroup OR ec2:RunInstances
emit:
source_type: Identity
source: <principal>
target: <instance-profile role in scope>
permissions:
- iam:PassRole
conditions:
- iam_permission
- condition_expression
- role_compatibility
false_positive_note: "iam:PassRole is normally scoped by role ARN AND iam:PassedToService. A role passable\
\ only to a non-ec2 service, or a role ARN the attacker cannot target, does NOT yield ASG execution\
\ \u2014 emit CONDITIONAL/POTENTIAL, not ACTIVE. Resolve the instance profile to its contained role\
\ before rating privilege."
narrative: '{principal.name} can pass instance-profile role {target.name} to EC2 via an Auto Scaling
launch template/config (iam:PassRole, PassedToService=ec2).'