rage.fail

aws-attach-group-policy

derived aws emits CanGrantPermission

match (effective permission)

{ "action": "iam:AttachGroupPolicy", "resource_type": "AWS::IAM::Group" }

where

?principal MemberOf ?group (else escalation only benefits group members)

emit

source	`<principal>`
target	`<IAM group in scope>`
permissions	`iam:AttachGroupPolicy`

Narrative

{principal.name} can attach a policy to group {group.name} it belongs to (iam:AttachGroupPolicy).

Raw rule rules/derived/aws/identity-escalation.yaml

id: aws-attach-group-policy
emits: CanGrantPermission
match_effective_permission:
  action: iam:AttachGroupPolicy
  resource_type: AWS::IAM::Group
where:
- ?principal MemberOf ?group  (else escalation only benefits group members)
emit:
  source: <principal>
  target: <IAM group in scope>
  permissions:
  - iam:AttachGroupPolicy
  narrative: '{principal.name} can attach a policy to group {group.name} it belongs to (iam:AttachGroupPolicy).'