rage.fail

aws-attach-role-policy

derived aws emits CanGrantPermission

match (effective permission)

{ "action": "iam:AttachRolePolicy", "resource_type": "AWS::IAM::Role" }

where

?principal can assume ?role OR ?role is assumable path exists

emit

source	`<principal>`
target	`<IAM role in scope>`
permissions	`iam:AttachRolePolicy`

Narrative

{principal.name} can attach a policy to {role.name} (iam:AttachRolePolicy).

Raw rule rules/derived/aws/identity-escalation.yaml

id: aws-attach-role-policy
emits: CanGrantPermission
match_effective_permission:
  action: iam:AttachRolePolicy
  resource_type: AWS::IAM::Role
where:
- ?principal can assume ?role OR ?role is assumable path exists
emit:
  source: <principal>
  target: <IAM role in scope>
  permissions:
  - iam:AttachRolePolicy
  escalation: Attach admin policy to an assumable role, then assume it.
  narrative: '{principal.name} can attach a policy to {role.name} (iam:AttachRolePolicy).'