aws-asg-update-attach-identity
Update an ASG / swap its launch template or config to launch instances as a more-privileged instance-profile role.
match (effective permission)
{
"action": "autoscaling:UpdateAutoScalingGroup",
"resource_type": "AWS::AutoScaling::AutoScalingGroup"
}
where
caller can reference a launch template/config whose IamInstanceProfile is a more-privileged role
caller holds in-scope iam:PassRole (PassedToService=ec2) for that role (else use the SLR-bypass rule)
caller holds ec2:RunInstances (checked via ASG dry-run)
emit
| source type | Identity |
|---|---|
| target type | Compute |
| source | <principal> |
| target | <Auto Scaling group / newly launched instances> |
| permissions | autoscaling:UpdateAutoScalingGroup iam:PassRole ec2:RunInstances |
| conditions | iam_permission role_compatibility trigger_exists |
Narrative
{principal.name} can update ASG {target.name} so its launched instances run as instance-profile role {role.name} (autoscaling:UpdateAutoScalingGroup). The role->CanExecuteAs handoff is carried by aws-asg-execute-as, not by this CanAttachIdentity edge (schema: Identity -> Compute).
Raw rule rules/derived/aws/autoscaling.yaml
id: aws-asg-update-attach-identity
emits: CanAttachIdentity
description: Update an ASG / swap its launch template or config to launch instances as a more-privileged
instance-profile role.
match_effective_permission:
action: autoscaling:UpdateAutoScalingGroup
resource_type: AWS::AutoScaling::AutoScalingGroup
where:
- caller can reference a launch template/config whose IamInstanceProfile is a more-privileged role
- caller holds in-scope iam:PassRole (PassedToService=ec2) for that role (else use the SLR-bypass rule)
- caller holds ec2:RunInstances (checked via ASG dry-run)
emit:
source_type: Identity
target_type: Compute
source: <principal>
target: <Auto Scaling group / newly launched instances>
permissions:
- autoscaling:UpdateAutoScalingGroup
- iam:PassRole
- ec2:RunInstances
conditions:
- iam_permission
- role_compatibility
- trigger_exists
note: Chains to CanExecuteAs(instance-profile role) once the ASG launches fresh instances (see aws-asg-force-launch-trigger
/ aws-asg-execute-as).
false_positive_note: Only future launches use the new config; existing instances are unaffected until
replaced. Without a scaling policy/scheduled action or SetDesiredCapacity/StartInstanceRefresh/terminate
rights, emit CONDITIONAL(trigger_exists).
narrative: '{principal.name} can update ASG {target.name} so its launched instances run as instance-profile
role {role.name} (autoscaling:UpdateAutoScalingGroup). The role->CanExecuteAs handoff is carried by
aws-asg-execute-as, not by this CanAttachIdentity edge (schema: Identity -> Compute).'