rage.fail

aws-batch-pass-instance-role

derived aws emits CanPassIdentity

match (effective permission)

{ "action": "iam:PassRole", "resource_type": "AWS::IAM::Role" }

where

principal has batch:CreateComputeEnvironment OR batch:UpdateComputeEnvironment PassedToService condition (if any) includes ec2.amazonaws.com / ecs.amazonaws.com

emit

source type	`Identity`
source	`<principal>`
target	`<instanceRole / service role passable in scope>`
permissions	`iam:PassRole` `batch:CreateComputeEnvironment`
conditions	`iam_permission` `condition_expression` `role_compatibility`

Narrative

{principal.name} can pass {role.name} as the EC2 instance role of a Batch compute environment (iam:PassRole + batch:CreateComputeEnvironment).

Raw rule rules/derived/aws/batch.yaml

id: aws-batch-pass-instance-role
emits: CanPassIdentity
match_effective_permission:
  action: iam:PassRole
  resource_type: AWS::IAM::Role
where:
- principal has batch:CreateComputeEnvironment OR batch:UpdateComputeEnvironment
- PassedToService condition (if any) includes ec2.amazonaws.com / ecs.amazonaws.com
emit:
  source_type: Identity
  source: <principal>
  target: <instanceRole / service role passable in scope>
  permissions:
  - iam:PassRole
  - batch:CreateComputeEnvironment
  conditions:
  - iam_permission
  - condition_expression
  - role_compatibility
  narrative: '{principal.name} can pass {role.name} as the EC2 instance role of a Batch compute environment
    (iam:PassRole + batch:CreateComputeEnvironment).'