rage.fail

aws-batch-instance-role-via-privileged

A privileged Batch container on an EC2 compute environment can read the instance role from IMDS.

derived aws emits CanRetrieveToken

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} CanExecuteAs {'jobrole': None} {'job': None} ExecutesAs {'instancerole': None}

where

?job runs on an EC2/SPOT compute environment container registered/submitted with privileged=true (batch:Privileged not denied) OR host access available

emit

source	`?principal`
target	`?instancerole`
permissions	`batch:RegisterJobDefinition` `batch:SubmitJob`
conditions	`service_state` `condition_expression`

Narrative

{principal.name} can run a privileged Batch container on EC2 compute environment and read the instance-role credentials {instancerole.name} from IMDS.

Raw rule rules/derived/aws/batch.yaml

id: aws-batch-instance-role-via-privileged
emits: CanRetrieveToken
description: A privileged Batch container on an EC2 compute environment can read the instance role from
  IMDS.
match:
- - principal: null
  - CanExecuteAs
  - jobrole: null
- - job: null
  - ExecutesAs
  - instancerole: null
where:
- ?job runs on an EC2/SPOT compute environment
- container registered/submitted with privileged=true (batch:Privileged not denied) OR host access available
emit:
  source: ?principal
  target: ?instancerole
  permissions:
  - batch:RegisterJobDefinition
  - batch:SubmitJob
  state: CONDITIONAL
  conditions:
  - service_state
  - condition_expression
  false_positive_note: "Fargate/EKS CEs expose no EC2 instance role; a hardened CE with IMDSv2 hop-limit\
    \ 1 + batch:Privileged denied blocks this \u2014 mark BLOCKED. Only applies to EC2/SPOT compute environments.\
    \ This rule emits only CanRetrieveToken(->instanceRole); the retrieved credential rolls up to CanExecuteAs(?principal\
    \ -> ?instancerole) via the generic CanRetrieveToken + target-Identity derivation, keeping the rule\
    \ single-edge while still connecting the escalation graph."
  derived_from:
  - CanExecuteAs
  - ExecutesAs
  narrative: '{principal.name} can run a privileged Batch container on EC2 compute environment and read
    the instance-role credentials {instancerole.name} from IMDS.'