rage.fail

aws-assume-role-web-identity

derived aws emits CanFederateAs

match (record)

{ "field": "AssumeRolePolicyDocument", "resource_type": "AWS::IAM::Role" }

where

trust policy Federated = an OIDC/SAML provider (e.g. token.actions.githubusercontent.com, oidc.eks...) condition (sub/aud) matches an attacker-controllable subject

emit

source	`<external/federated identity>`
target	`<IAM role>`
permissions	`sts:AssumeRoleWithWebIdentity \| sts:AssumeRoleWithSAML`
conditions	`trust_relationship` `condition_expression`

Narrative

{external.name} can federate into {role.name} via OIDC/SAML trust (sts:AssumeRoleWithWebIdentity).

Raw rule rules/derived/aws/identity-escalation.yaml

id: aws-assume-role-web-identity
emits: CanFederateAs
match_record:
  resource_type: AWS::IAM::Role
  field: AssumeRolePolicyDocument
where:
- trust policy Federated = an OIDC/SAML provider (e.g. token.actions.githubusercontent.com, oidc.eks...)
- condition (sub/aud) matches an attacker-controllable subject
emit:
  source: <external/federated identity>
  target: <IAM role>
  permissions:
  - sts:AssumeRoleWithWebIdentity | sts:AssumeRoleWithSAML
  conditions:
  - trust_relationship
  - condition_expression
  false_positive_note: Only emit ACTIVE if the sub/aud condition is attacker-satisfiable (e.g. wildcard
    sub, self-hosted repo). Otherwise POTENTIAL.
  narrative: '{external.name} can federate into {role.name} via OIDC/SAML trust (sts:AssumeRoleWithWebIdentity).'