aws-batch-create-workload-as

Create/register Batch workload bound to a passed identity (create + pass).

derived aws emits CanCreateWorkloadAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?jobrole`
permissions	`batch:RegisterJobDefinition` `batch:SubmitJob` `iam:PassRole`
conditions	`iam_permission` `condition_expression` `role_compatibility`
state logic	ACTIVE if iam:PassRole PassedToService admits ecs-tasks.amazonaws.com and batch:SubmitJob is present; else CONDITIONAL(iam_permission, condition_expression).

source type

Identity

target type

Identity

source

?principal

target

?jobrole

permissions

batch:RegisterJobDefinition batch:SubmitJob iam:PassRole

conditions

iam_permission condition_expression role_compatibility

state logic

ACTIVE if iam:PassRole PassedToService admits ecs-tasks.amazonaws.com and batch:SubmitJob is present; else CONDITIONAL(iam_permission, condition_expression).

Narrative

{principal.name} can create a new Batch job definition bound to {jobrole.name} and run it (register + PassRole + SubmitJob).

Raw rule rules/derived/aws/batch.yaml

id: aws-batch-create-workload-as
emits: CanCreateWorkloadAs
description: Create/register Batch workload bound to a passed identity (create + pass).
match:
- - principal: null
  - CanPassIdentity
  - jobrole: null
where:
- ?principal has batch:RegisterJobDefinition AND batch:SubmitJob
- ?jobrole passable to ecs-tasks.amazonaws.com
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?jobrole
  permissions:
  - batch:RegisterJobDefinition
  - batch:SubmitJob
  - iam:PassRole
  state_logic: ACTIVE if iam:PassRole PassedToService admits ecs-tasks.amazonaws.com and batch:SubmitJob
    is present; else CONDITIONAL(iam_permission, condition_expression).
  conditions:
  - iam_permission
  - condition_expression
  - role_compatibility
  conditions_from:
  - jobrole: null
  derived_from:
  - CanPassIdentity
  false_positive_note: "iam:PassRole scoped by iam:PassedToService/ARN \u2014 a role passable only to\
    \ ec2.amazonaws.com does not become a Batch task role; honor the condition. Differs from aws-batch-execute-as-register-submit:\
    \ CanCreateWorkloadAs is the capability to create the bound workload (register + PassRole + SubmitJob),\
    \ whereas CanExecuteAs is the realized execution of attacker code as ?jobrole. This rule captures\
    \ the create/bind step; the execute rule captures the running outcome."
  narrative: '{principal.name} can create a new Batch job definition bound to {jobrole.name} and run it
    (register + PassRole + SubmitJob).'