aws-batch-execute-as-submit-existing
Submit an existing definition (with command override) whose bound jobRole is privileged - no PassRole needed.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?principal has batch:SubmitJob with container command/env override permitted (no condition blocks overrides)
?jobrole.privilege_level >= ?principal.privilege_level
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | ?principal |
| target | ?jobrole |
| permissions | batch:SubmitJob |
Narrative
{principal.name} can submit existing Batch definition {jobdef.name} with a command override, executing as its privileged role {jobrole.name} (batch:SubmitJob) without needing iam:PassRole.
Raw rule rules/derived/aws/batch.yaml
id: aws-batch-execute-as-submit-existing
emits: CanExecuteAs
description: "Submit an existing definition (with command override) whose bound jobRole is privileged\
\ \u2014 no PassRole needed."
match:
- - principal: null
- CanInvoke
- jobdef: null
- - jobdef: null
- ExecutesAs
- jobrole: null
where:
- ?principal has batch:SubmitJob with container command/env override permitted (no condition blocks overrides)
- ?jobrole.privilege_level >= ?principal.privilege_level
emit:
source_type: Identity
target_type: Identity
source: ?principal
target: ?jobrole
permissions:
- batch:SubmitJob
state: ACTIVE
conditions_from:
- jobdef: null
- jobrole: null
false_positive_note: Only escalates when the existing definition already binds a MORE-privileged jobRoleArn.
If the definition has no jobRoleArn or an equal/lower-priv role, do not emit. Container overrides
may be restricted by policy.
derived_from:
- CanInvoke
- ExecutesAs
narrative: '{principal.name} can submit existing Batch definition {jobdef.name} with a command override,
executing as its privileged role {jobrole.name} (batch:SubmitJob) without needing iam:PassRole.'