rage.fail

aws-attach-user-policy

derived aws emits CanGrantPermission

match (effective permission)

{ "action": "iam:AttachUserPolicy", "resource_type": "AWS::IAM::User" }

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<IAM user in scope (incl. self)>`
permissions	`iam:AttachUserPolicy`

Narrative

{principal.name} can attach a managed policy to {target.name} (iam:AttachUserPolicy), granting arbitrary permissions.

Raw rule rules/derived/aws/identity-escalation.yaml

id: aws-attach-user-policy
emits: CanGrantPermission
match_effective_permission:
  action: iam:AttachUserPolicy
  resource_type: AWS::IAM::User
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <IAM user in scope (incl. self)>
  permissions:
  - iam:AttachUserPolicy
  escalation: Attach AdministratorAccess (or any managed policy) to a controllable user.
  narrative: '{principal.name} can attach a managed policy to {target.name} (iam:AttachUserPolicy), granting
    arbitrary permissions.'