rage.fail

aws-assume-role

derived aws emits CanAssume

match (effective permission)

{ "action": "sts:AssumeRole", "resource_type": "AWS::IAM::Role" }

where

?role trust policy Principal allows ?principal (same or cross account) no SCP/boundary denies sts:AssumeRole

emit

source type	`Identity`
source	`<principal>`
target	`<IAM role>`
permissions	`sts:AssumeRole`
conditions	`trust_relationship` `condition_expression`

Narrative

{principal.name} can assume {role.name} (sts:AssumeRole; trust policy permits it).

Raw rule rules/derived/aws/identity-escalation.yaml

id: aws-assume-role
emits: CanAssume
match_effective_permission:
  action: sts:AssumeRole
  resource_type: AWS::IAM::Role
where:
- ?role trust policy Principal allows ?principal (same or cross account)
- no SCP/boundary denies sts:AssumeRole
emit:
  source_type: Identity
  source: <principal>
  target: <IAM role>
  permissions:
  - sts:AssumeRole
  conditions:
  - trust_relationship
  - condition_expression
  cross_account: if role.account != principal.account -> also emits CrossAccountTrust + feeds CanEnterAccount
  narrative: '{principal.name} can assume {role.name} (sts:AssumeRole; trust policy permits it).'